Missing Authorization in Booking Calendar Plugin Allows Sensitive Data Exposure

CVE-2025-14982

What is CVE-2025-14982?

The Booking Calendar plugin for WordPress has a vulnerability that allows authenticated users with Subscriber-level access and above to bypass authorization checks. This flaw results in the exposure of sensitive booking records, which include personally identifiable information (PII) like names, email addresses, phone numbers, and physical addresses from other users' database entries. As a result, attackers can view critical information including payment statuses and booking costs, raising significant privacy concerns.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References