CVE-2026-89008 Overview
CVE-2026-89008 is an information disclosure vulnerability in the Bookit — Booking & Appointment Calendar WordPress plugin in versions before 2.6.0.5. The plugin fails to enforce an authorization check on one of its appointment-retrieval actions. Users assigned a low-privilege plugin-specific role can read other users' appointment records. Exposed data includes customer names, email addresses, phone numbers, and private booking comments. The issue is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Authenticated low-privilege users can enumerate personally identifiable information (PII) from other customers' bookings, creating privacy exposure and potential downstream phishing risk.
Affected Products
- Bookit — Booking & Appointment Calendar WordPress plugin versions prior to 2.6.0.5
- WordPress sites running the vulnerable plugin with additional low-privilege plugin roles assigned
- Any site exposing booking data with sensitive customer PII through this plugin
Discovery Timeline
- 2026-09-18 - CVE-2026-89008 published to the National Vulnerability Database (NVD)
- 2026-09-18 - Last updated in NVD database
Technical Details for CVE-2026-89008
Vulnerability Analysis
The vulnerability resides in an appointment-retrieval action exposed by the Bookit plugin. The action processes requests from authenticated users but omits an authorization check that binds the returned records to the requesting user's identity. As a result, any authenticated user holding a low-privilege plugin-specific role can invoke the action and receive appointment records belonging to other customers.
The returned records contain customer names, email addresses, phone numbers, and free-form booking comments. These fields commonly contain sensitive context such as medical notes, service preferences, or scheduling details. Exposure of this data violates data protection expectations and provides an attacker with a curated list of contact information for targeted phishing or social engineering.
Root Cause
The root cause is a missing authorization control on a plugin AJAX or REST action that returns appointment data. Authentication is verified, but authorization — the check that the requester owns or is permitted to view the target record — is absent. This maps to CWE-200 and reflects a broken access control pattern common in WordPress plugin AJAX handlers.
Attack Vector
Exploitation requires network access to the WordPress site and authenticated access with the plugin-specific low-privilege role. An attacker sends a crafted request to the vulnerable appointment-retrieval action and parses the returned data. No user interaction is required. Refer to the WPScan Vulnerability Report for the technical write-up.
No public proof-of-concept is listed in the enriched data, and the vulnerability is not on the CISA Known Exploited Vulnerabilities (KEV) list.
Detection Methods for CVE-2026-89008
Indicators of Compromise
- Unusual volume of authenticated requests to Bookit plugin AJAX endpoints (typically under /wp-admin/admin-ajax.php with a Bookit-specific action parameter) from a single low-privilege account.
- Access log entries showing sequential or bulk retrieval of appointment records by non-administrative users.
- Outbound data staging or export activity following authenticated access to Bookit endpoints.
Detection Strategies
- Audit WordPress user roles for accounts assigned the Bookit plugin-specific low-privilege role and correlate their activity against booking data access.
- Enable and review WordPress audit logging (via a plugin or reverse proxy) for calls to Bookit appointment-retrieval actions.
- Compare the requesting user's identity in access logs against the customer identifier tied to returned records where feasible.
Monitoring Recommendations
- Monitor admin-ajax.php traffic patterns for high-frequency reads from non-admin sessions.
- Alert on new or unexpected role assignments involving Bookit plugin roles.
- Track outbound email or messaging activity from accounts that recently accessed Bookit endpoints to identify potential phishing follow-on.
How to Mitigate CVE-2026-89008
Immediate Actions Required
- Upgrade the Bookit — Booking & Appointment Calendar plugin to version 2.6.0.5 or later on all WordPress installations.
- Inventory and reduce the number of accounts holding the plugin-specific low-privilege role until patched.
- Rotate any credentials or notify customers if log review indicates data was accessed by unauthorized users.
Patch Information
The vendor addressed the missing authorization check in Bookit version 2.6.0.5. Administrators should update through the WordPress plugin manager or by deploying the updated plugin package. Confirm the installed version is 2.6.0.5 or higher after applying the update. See the WPScan Vulnerability Report for advisory details.
Workarounds
- Temporarily remove or reassign users holding the vulnerable low-privilege plugin role until the patch is deployed.
- Restrict access to admin-ajax.php Bookit actions at the web application firewall (WAF) or reverse proxy layer, limiting requests to administrators.
- Disable the Bookit plugin if patching is not immediately possible and the exposure of customer PII is unacceptable.
# Verify the installed Bookit plugin version using WP-CLI
wp plugin get bookit --field=version
# Update the Bookit plugin to the patched release
wp plugin update bookit --version=2.6.0.5
# Audit users assigned the Bookit-specific low-privilege role (replace role slug as needed)
wp user list --role=bookit_customer --fields=ID,user_login,user_email
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
