Description

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does not properly restrict the data returned by an availability-check request, allowing unauthenticated users to retrieve other customers' appointment details, including free-text booking comments and contact information.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-13T06:16:25.543Z",
  "pubdate": "2026-09-13T06:16:25.543Z",
  "executiveSummary": "The Bookit WordPress plugin, versions prior to 2.6.0.1, contains an Improper Access Control vulnerability that leads to sensitive information disclosure. This flaw allows unauthenticated remote attackers to access private customer appointment data via unauthorized availability-check requests.\nThe vulnerability type is categorized as an authorization bypass, specifically failing to enforce access restrictions on internal booking data retrieval. The impact includes the unauthorized exposure of Personally Identifiable Information (PII), such as full customer contact details and private free-text booking comments.\nThe affected system is the Bookit plugin suite. Risk implications are severe, as the vulnerability is exploitable by any unauthenticated user with network access to the target WordPress installation, requiring no prior knowledge of credentials or elevated privileges. The exposure of customer data poses significant privacy risks and potential non-compliance with data protection regulations such as GDPR or CCPA. There are no complex prerequisites for exploitation; an attacker simply needs to interact with the publicly accessible availability-check endpoint to retrieve data belonging to arbitrary users.",
  "technicalDetails": "The vulnerability resides within the availability-check functionality of the Bookit plugin, which fails to implement necessary server-side authorization checks for incoming requests. In versions prior to 2.6.0.1, the plugin's backend logic processes requests intended to verify booking slots without validating the identity or session authorization of the requester.\nRoot Cause: The root cause is an insecure API endpoint design that returns excessive data structures in response to availability queries. The application logic lacks an explicit check to ensure that the requester has administrative privileges or is the authenticated owner of the specific booking record before serializing and returning customer data to the client-side.\nExploitation Method: An attacker can exploit this by crafting a request to the plugin's availability-check endpoint. Because the endpoint does not verify the requester, the application performs a database query for appointment records. Due to the lack of filtering, the application retrieves and returns objects containing sensitive fields, including customer names, telephone numbers, email addresses, and free-text comment fields associated with existing appointments.\nAttack Flow: 1. The attacker identifies the publicly accessible endpoint used by Bookit for availability checks. 2. The attacker sends a crafted request (typically via HTTP GET or POST) to this endpoint. 3. The plugin backend receives the request and, lacking authentication validation, retrieves appointment details directly from the WordPress database. 4. The server serializes the full dataset—including private customer contact and personal data—into the HTTP response body. 5. The attacker parses the JSON/data response, effectively exfiltrating PII without authentication.\nNetwork Exposure and Privilege Requirements: The vulnerability is reachable over the network and requires zero authentication. It is exploitable by any external actor with connectivity to the web server, making it a critical risk for public-facing WordPress sites. Post-exploitation, an attacker gains immediate access to a persistent stream of customer metadata, which can be leveraged for further malicious activities such as social engineering, identity theft, or data harvesting for targeted phishing campaigns."
}