CVE-2026-89008 is an information exposure vulnerability classified as CWE-200 in the Bookit — Booking & Appointment Calendar WordPress plugin. Versions prior to 2.6.0.5 do not perform adequate authorization checks on an appointment-retrieval action, enabling low-privilege users assigned a Bookit-specific role to read appointment data belonging to other users. The exposed data includes personally identifiable information and private booking comments.

The vulnerability allows unauthorized disclosure of sensitive customer information, including names, email addresses, phone numbers, and private booking comments. This could lead to privacy violations and potential misuse of personal data. There is no indication of active exploitation in the wild.

Upgrade the Bookit — Booking & Appointment Calendar plugin to version 2.6.0.5 or later, where this authorization issue is fixed. Since the vulnerability is resolved in this version, applying the official update fully mitigates the risk.