CVE-2026-108123

Executive Summary

CVE-2026-108123 is an authorization bypass (CWE-862, Missing Authorization) in the WordPress plugin "WP Booking System – Booking Calendar" affecting all versions up to and including 2.1.0.3. The flaw allows an attacker to read stored notification email bodies for arbitrary bookings by iterating booking_id and email_log_id parameters, disclosing customer PII (names, email addresses, phone numbers, messages, and booking dates) that should be restricted to administrators. Although the CVSS vector lists PR:N, the NVD description notes practical exploitation is trivial for any authenticated Subscriber-level user because the vulnerable handler is reachable via admin_init on profile.php. Impact is high confidentiality loss (C:H) with no integrity or availability effect.

Technical Analysis

The vulnerability stems from a missing authorization check on a handler registered to the WordPress admin_init hook. In WordPress, admin_init fires for every load of any wp-admin page — including profile.php, which is accessible to all authenticated users regardless of role. Because the plugin's callback does not verify that the requesting user holds administrative capabilities (e.g., via a current_user_can() check) before serving notification-log data, any logged-in user can invoke the handler.

The data exposed is the stored body of notification emails associated with bookings. The NVD description states the handler can be driven by iterating two parameters — booking_id and email_log_id — which together reference a specific notification record. By incrementing these identifiers, an attacker can enumerate records belonging to other customers and retrieve the underlying PII (customer name, email address, phone number, message content, and booking date). The vulnerability class is a classic insecure direct object reference (IDOR) manifesting as missing function-level authorization: the code path exists and returns data, but lacks the capability gate that would restrict it to administrators.

The CVSS vector AV:N/AC:L/PR:N/UI:N reflects that the endpoint is network-reachable, requires no special conditions, and (per the base vector) no privileges and no user interaction. The prose in the description adds operational nuance: while a Subscriber account is the minimum practical requirement, Subscriber registration is frequently open on WordPress sites (e.g., booking, membership, or comment-driven sites), effectively lowering the barrier toward the PR:N rating. There is insufficient technical detail in the provided data to cite specific function, class, route, or nonce names; the analysis above is derived strictly from the NVD description and the CWE-862 classification.

Exploitation Scenarios

No public PoC, Nuclei template, or exploit code is available; the attack chain below is inferred from the vulnerability class (missing authorization / IDOR on an admin_init handler).

1. Reconnaissance / target identification. An attacker identifies WordPress sites running the "WP Booking System – Booking Calendar" plugin, typically via plugin asset paths under /wp-content/plugins/ (e.g., directory/asset fingerprinting) or by Shodan/HTTP body signatures. Sites with public booking functionality and open Subscriber registration are ideal because they guarantee both a booking dataset and a low-privilege foothold.

2. Privilege acquisition. Because the handler fires on admin_init, the attacker authenticates as any user (Subscriber is sufficient per the description). Where registration is open, the attacker self-registers; otherwise any compromised low-privilege account suffices. No administrative role is required.

3. Triggering the flaw. The attacker sends requests that reach the plugin's admin_init callback (e.g., loading profile.php while supplying the booking_id and email_log_id parameters). Since no current_user_can() authorization check gates the handler, the server returns the stored notification email body for the referenced booking. The attacker iterates booking_id and email_log_id values to walk the record space.

4. Post-exploitation impact. Harvested notification bodies yield customer PII — names, email addresses, phone numbers, free-text messages, and booking dates. This enables phishing/social-engineering of customers, business-email-compromise targeting, doxxing, and downstream credential or payment attacks. Because the access is read-only, the attacker leaves no data-modification footprint; detection hinges on anomalous enumeration patterns (see Detection Guidance).

Impact Assessment

• Confidentiality: High (C:H). Bulk disclosure of customer PII across all bookings.
• Integrity: None (I:N) and Availability: None (A:N) — the flaw is read-only.
• Attack Vector: Network (AV:N), Attack Complexity: Low (AC:L), Privileges Required: None in the base vector (PR:N), User Interaction: None (UI:N). Base score 7.5 (High).
• Blast radius. Every site running an affected version (≤ 2.1.0.3) with stored bookings is exposed. Because the handler is reachable by any authenticated user, the effective population is all customers whose bookings generated notification emails — potentially the entire customer base.
• Regulatory exposure. Disclosure of names, emails, phones, and messages is a personal-data breach under regimes such as GDPR and CCPA, triggering notification obligations and potential fines. Enterprise impact concentrates on confidentiality and compliance rather than service disruption.

Detection Guidance

Sigma Rule

title: WP Booking System Booking Notification Log Enumeration (CVE-2026-108123)
id: 7c1f9a2e-3b4d-4e8a-9f10-cve2026108123
status: experimental
description: Detects low-privilege or unauthenticated access to profile.php carrying booking_id and email_log_id parameters, indicating exploitation of missing authorization in WP Booking System plugin.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-108123
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: apache
detection:
  selection_path:
    cs-uri-stem|endswith:
      - '/wp-admin/profile.php'
      - '/wp-admin/admin-ajax.php'
  selection_params:
    cs-uri-query|contains|all:
      - 'booking_id'
      - 'email_log_id'
  condition: selection_path and selection_params
fields:
  - c-ip
  - cs-uri-query
  - cs-username
falsepositives:
  - Legitimate administrator viewing a single booking notification
level: high

YARA Rule

rule CVE_2026_108123_WP_Booking_System_IDOR
{
    meta:
        description = "Detects WP Booking System plugin files referencing notification log retrieval without capability checks (CVE-2026-108123)"
        cve = "CVE-2026-108123"
        author = "Threat Intelligence"
        date = "2026-01-01"
    strings:
        $plugin = "WP Booking System" ascii nocase
        $hook   = "admin_init" ascii
        $param1 = "booking_id" ascii
        $param2 = "email_log_id" ascii
        $can    = "current_user_can" ascii
    condition:
        $plugin and $hook and $param1 and $param2 and filesize < 5MB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-108123 WP Booking System Notification Log Enumeration"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/wp-admin/profile.php"; http.uri; content:"booking_id"; http.uri; content:"email_log_id"; classtype:web-application-attack; reference:cve,2026-108123; sid:2026108123; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [ url.path : "/wp-admin/profile.php" and url.query : *booking_id* and url.query : *email_log_id* ]
  [ url.path : "/wp-admin/profile.php" and url.query : *booking_id* and url.query : *email_log_id* ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval is_profile = if(like(uri_path, "%/wp-admin/profile.php"), 1, 0)
| eval has_booking = if(like(uri_query, "%booking_id%"), 1, 0)
| eval has_log = if(like(uri_query, "%email_log_id%"), 1, 0)
| where is_profile=1 AND has_booking=1 AND has_log=1
| stats count values(uri_query) as queries by src_ip user
| where count >= 5
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,cve-2026-108123,">
  <rule id="2026108123" level="10">
    <if_sid>31100</if_sid>
    <match>booking_id</match>
    <match>email_log_id</match>
    <match>/wp-admin/profile.php</match>
    <description>CVE-2026-108123: WP Booking System notification log enumeration (IDOR) attempt</description>
    <mitre>
      <id>T1213</id>
    </mitre>
    <group>pii_disclosure,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed).

1. Immediate mitigations (no verified patch):

   • Disable or restrict the WP Booking System plugin if bookings store sensitive customer data.
   • Restrict or disable open Subscriber registration so the practical foothold is removed.
   • Enforce WAF rules blocking requests to wp-admin URLs carrying simultaneous booking_id and email_log_id parameters from low-privilege roles.
   • Audit plugin configuration to minimize stored PII in notification logs; purge existing logs where feasible.

2. Patch / upgrade: Confirm with the vendor (WP Booking System) whether a fixed release exists and apply the latest available version. Since only NVD claims a patch and no version is specified, do not assume a version greater than 2.1.0.3 is patched — validate against an official vendor changelog before considering remediation complete.

3. Long-term hardening: Adopt a vulnerability-management process for third-party WordPress plugins; enforce role least-privilege and capability checks; enable central logging with the detections above; and monitor for updated vendor guidance. Maintain a WordPress plugin inventory to rapidly identify exposed systems.

References

• NVD — CVE-2026-108123: https://nvd.nist.gov/vuln/detail/CVE-2026-108123
• MITRE CWE-862 (Missing Authorization): https://cwe.mitre.org/data/definitions/862.html
• WordPress Plugin Security documentation: https://developer.wordpress.org/plugins/security/
• CISA KEV Catalog (verify status; current data indicates NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• WordPress admin_init hook reference: https://developer.wordpress.org/reference/hooks/admin_init/

No public PoC, exploit code, or threat-actor campaign is currently associated with this CVE per the provided intelligence.