CVE-2026-96886: Course Booking System Information Disclosure

CVE-2026-96886 Overview

CVE-2026-96886 is an unauthenticated information disclosure vulnerability in the Course Booking System WordPress plugin. Versions prior to 7.0.9 fail to restrict access to the plugin's booking export functionality. Unauthenticated remote attackers can download the full customer booking dataset, including names, email addresses, and billing addresses of every customer who booked a course.

The issue stems from missing access control on the export endpoint. Any visitor who knows the endpoint URL can retrieve the export without authentication or authorization checks.

Critical Impact
Unauthenticated attackers can exfiltrate personally identifiable information (PII) of all course customers, creating regulatory exposure under GDPR and similar privacy frameworks.

Affected Products

Course Booking System WordPress plugin versions before 7.0.9
WordPress sites with the vulnerable plugin installed and activated
Any deployment exposing the plugin's booking export endpoint to the internet

Discovery Timeline

2026-09-30 - CVE-2026-96886 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-96886

Vulnerability Analysis

The Course Booking System plugin exposes a booking export feature intended for site administrators. The export endpoint does not perform capability checks, nonce validation, or authentication verification before returning booking records. As a result, an anonymous HTTP request to the export handler returns the complete customer dataset.

The disclosed fields include customer full name, email address, and billing address. This is a Broken Access Control issue mapped to the Missing Authorization class of weaknesses. Attackers do not require any user interaction, credentials, or elevated privileges to trigger the export.

Root Cause

The root cause is a missing authorization check on the plugin's booking export handler. The plugin registers the export route without verifying that the requesting user holds an administrative capability such as manage_options or a valid administrator nonce. The handler proceeds directly to query and serialize booking records for the response.

Attack Vector

Exploitation requires only network access to the target WordPress site. An attacker sends an unauthenticated HTTP request to the plugin's export endpoint and receives the exported booking data in the response. No prior reconnaissance beyond identifying the plugin is required. The technical details of the endpoint path and request format are documented in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-96886

Indicators of Compromise

Unauthenticated HTTP GET or POST requests to the Course Booking System plugin's export endpoint under /wp-admin/admin-ajax.php or plugin-specific paths
Anomalous response sizes from the plugin endpoint indicating bulk data export
Requests to the export endpoint originating from source IPs that never authenticated to the site

Detection Strategies

Review web server access logs for requests referencing the Course Booking System export action, particularly from unauthenticated sessions
Enable WordPress activity logging to correlate export events with logged-in administrator sessions and flag mismatches
Deploy a Web Application Firewall (WAF) rule that requires an authenticated administrator cookie for the export endpoint

Monitoring Recommendations

Alert on outbound response payloads from the plugin endpoint exceeding a baseline size threshold
Monitor for repeated requests from a single source IP to the plugin's AJAX or REST routes
Track installed plugin versions across managed WordPress sites and alert on Course Booking System instances below 7.0.9

How to Mitigate CVE-2026-96886

Immediate Actions Required

Update the Course Booking System plugin to version 7.0.9 or later on all affected WordPress sites
Audit web server logs for prior unauthenticated requests to the plugin's export endpoint and treat matches as a data breach
Notify affected customers and regulators if evidence of exploitation is found, in line with applicable data protection requirements

Patch Information

The vendor addressed the issue in Course Booking System version 7.0.9 by adding authorization checks to the booking export handler. Administrators should apply the update through the WordPress plugin manager. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Deactivate the Course Booking System plugin until it can be updated to version 7.0.9 or later
Restrict access to the plugin's export endpoint at the web server or WAF layer to known administrator IP addresses
Add HTTP basic authentication in front of /wp-admin/ and the plugin's AJAX handler to block unauthenticated requests

bash

# Example nginx rule to restrict the plugin export endpoint to trusted IPs
location ~* /wp-admin/admin-ajax\.php {
    if ($arg_action ~* "course_booking_export") {
        allow 203.0.113.10;
        deny all;
    }
}