Authorization Bypass in WP Booking System Plugin for WordPress

CVE-2026-108123

What is CVE-2026-108123?

The WP Booking System plugin for WordPress has a serious authorization bypass vulnerability across all versions up to 2.1.0.3. The flaw allows unauthenticated individuals to exploit the system by reading sensitive stored notification emails related to bookings. This security lapse is primarily due to inadequate verification of user permissions, enabling attackers even at the Subscriber level to access personal identifiable information (PII) of customers, including names, email addresses, phone numbers, and booking details, which are typically restricted to administrative visibility. This vulnerability highlights a critical oversight in user authentication safeguards within the plugin, necessitating immediate attention and patching to protect sensitive data.

References