CVE-2026-109368 murgroland CVE debrief

Who should care

Defenders managing WordPress sites with the WP Booking System – Booking Calendar plugin should assess exposure and verify access controls to protect sensitive event data. This includes reviewing the plugin's access controls, monitoring for potential exploitation attempts, and ensuring proper authorization for accessing sensitive event data. Additionally, defenders should prioritize verifying and restricting access to sensitive event data, especially for

Why it matters

CVE-2026-109368 is a Sensitive Information Exposure vulnerability in the WP Booking System – Booking Calendar plugin for WordPress. Authenticated attackers with subscriber-level access can extract private per-event booking descriptions and IDs from any calendar managed by the site. Defenders managing WordPress sites with this plugin should assess exposure and verify access controls to protect sensitive event data. The vulnerability has a CVSS score of 6.5 and is considered medium severity.

• Authenticated attackers with subscriber-level access can extract sensitive event data
• Private per-event booking descriptions and IDs are at risk of exposure
• Defenders must verify and restrict access to sensitive event data
• Remediation priority is medium due to the vulnerability's CVSS score of 6.5

Technical summary

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.0.3 via the 'id' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract private per-event booking descriptions and booking IDs from any calendar managed by the site. The vulnerability has a CVSS score of 6.5 and is considered medium severity. The exposure of sensitive event data could lead to privacy breaches and unauthorized information disclosure.

Defensive priority

Defenders should prioritize verifying and restricting access to sensitive event data, especially for subscribers and above, and review the plugin's access controls.

Recommended defensive actions

• Verify and restrict access to sensitive event data, especially for subscribers and above
• Review the plugin's access controls and ensure proper authorization
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability allows authenticated attackers with subscriber-level access to extract private per-event booking descriptions and booking IDs from any calendar managed by the site. This is due to the 'id' parameter in the WP Booking System – Booking Calendar plugin for WordPress being vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.0.3.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.