CVE-2026-109368: WP Booking System Information Disclosure

CVE-2026-109368 Overview

CVE-2026-109368 affects the WP Booking System – Booking Calendar plugin for WordPress in all versions up to and including 2.1.0.3. The vulnerability allows authenticated users with subscriber-level access or above to extract private booking data through the id parameter. Attackers can enumerate per-event booking descriptions and booking IDs from any calendar managed by the WordPress site. The flaw is categorized as Missing Authorization [CWE-862] and stems from insufficient capability checks in the plugin's AJAX calendar handlers. Site administrators relying on the plugin to store confidential event details face exposure of reservation metadata to any registered subscriber.

Critical Impact
Any authenticated WordPress user with subscriber permissions can enumerate booking descriptions and IDs across all calendars managed by the plugin.

Affected Products

WP Booking System – Booking Calendar plugin for WordPress
All versions up to and including 2.1.0.3
WordPress sites exposing subscriber registration with the plugin installed

Discovery Timeline

2026-10-17 - CVE-2026-109368 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-109368

Vulnerability Analysis

The vulnerability resides in the plugin's AJAX calendar endpoints, specifically within functions-actions-ajax-calendar.php and class-calendar-editor-outputter.php. The handlers accept an id parameter identifying a calendar or event but fail to verify whether the requesting user has permission to view the referenced resource. A subscriber-level account can submit crafted AJAX requests referencing arbitrary calendar IDs and receive back per-event booking descriptions and booking identifiers that should be restricted to site administrators and calendar owners. The exposed information may include customer-supplied booking notes, event metadata, and internal booking identifiers used elsewhere in administrative workflows.

Root Cause

The root cause is Missing Authorization [CWE-862]. The affected AJAX actions authenticate the user through standard WordPress nonce handling but do not enforce a capability check tying the subscriber to the calendar being accessed. The patched release addresses this gap in the trunk through WordPress Changeset #3750120, which adds the missing authorization logic to the AJAX endpoints.

Attack Vector

Exploitation requires only a subscriber account on the target WordPress site, a privilege level often granted automatically by sites that allow open user registration. The attacker sends crafted AJAX POST requests to the plugin's calendar endpoints, iterating through numeric id values to enumerate every calendar and its booking records. No user interaction or administrative privilege escalation is required. Source references for the vulnerable code paths are available in the WordPress Calendar Editor Outputter (L432) and WordPress AJAX Calendar Function (L12).

Detection Methods for CVE-2026-109368

Indicators of Compromise

Unusual volume of admin-ajax.php requests from subscriber accounts referencing WP Booking System action names.
Sequential or scripted iteration of the id parameter in AJAX requests targeting booking calendar endpoints.
Subscriber accounts accessing booking endpoints they have no business reason to query.

Detection Strategies

Review WordPress access logs for POST requests to wp-admin/admin-ajax.php with WP Booking System actions originating from low-privilege sessions.
Audit active subscriber accounts for recent registrations followed by immediate AJAX traffic to booking endpoints.
Correlate web server telemetry with the plugin version installed on each WordPress instance to flag hosts running 2.1.0.3 or earlier.

Monitoring Recommendations

Forward WordPress and web server logs to a centralized SIEM to enable queries across booking plugin endpoints.
Alert on repeated AJAX requests from a single authenticated session that enumerate incrementing id values.
Baseline normal booking endpoint access patterns to detect scripted enumeration against the plugin.

How to Mitigate CVE-2026-109368

Immediate Actions Required

Update the WP Booking System – Booking Calendar plugin to a version later than 2.1.0.3 that includes the authorization fix.
Review and remove unnecessary subscriber accounts, especially those registered recently without legitimate business justification.
Disable open user registration on WordPress sites that do not require it until the patched release is deployed.

Patch Information

The fix is applied in the plugin trunk through WordPress Changeset #3750120. Review the full change set between vulnerable and fixed revisions via the WordPress Changeset Old/New Comparison and the Wordfence Vulnerability Report #164a276a.

Workarounds

Temporarily deactivate the WP Booking System plugin until the patched version can be installed.
Restrict access to wp-admin/admin-ajax.php for subscriber-role sessions using a web application firewall rule targeting the plugin's AJAX actions.
Set WordPress membership settings so new registrations require administrator approval before gaining subscriber access.

bash

# Configuration example: disable open registration in wp-config.php via WordPress option
wp option update users_can_register 0
wp option update default_role subscriber