CVE-2026-109368

Executive Summary

CVE-2026-109368 is a Sensitive Information Exposure / Missing Authorization (CWE-862) vulnerability in the "WP Booking System – Booking Calendar" WordPress plugin affecting all versions up to and including 2.1.0.3. An authenticated attacker holding only subscriber-level privileges can abuse the id parameter to retrieve private per-event booking descriptions and booking IDs belonging to any calendar on the site, bypassing intended access controls. With a CVSS base score of 6.5, the flaw primarily threatens confidentiality of customer booking data and exposes identifiers that may enable follow-on enumeration.

Technical Analysis

The vulnerability resides in the plugin's handling of the id parameter. According to the NVD description, the plugin fails to enforce proper authorization checks on requests that reference a booking (or event) by its id, allowing an authenticated user with the lowest privileged role (subscriber) and above to retrieve data they should not access. The root cause aligns with CWE-862 (Missing Authorization): the code path that serves booking details does not verify that the requesting user is entitled to view the targeted record, nor that the record belongs to a calendar the user is permitted to access.

The attack surface is the plugin's booking-lookup functionality as exposed to authenticated site users. Because the exposure is keyed on the id parameter, the model is an insecure direct object reference–style weakness layered atop a missing capability check: any authenticated account, regardless of role, can supply an id value and receive the corresponding private booking description and booking ID. The description explicitly scopes the accessible data to "private per-event booking descriptions and booking IDs from any calendar managed by the site," confirming that the authorization boundary is per-calendar/per-event and that the flaw allows crossing it.

Notably, exploitation requires authentication (PR:L), so an attacker must first obtain a valid, low-privileged account — typically achievable on WordPress sites that permit open registration or self-service subscriber sign-up. No public proof-of-concept, Nuclei template, or exploit code is available as of this report, so the precise request structure is inferred from the vulnerability class and the disclosed id parameter only; implementation-level specifics (exact endpoint path, nonce handling, response format) are not available in the supplied data and are deliberately not fabricated here.

Exploitation Scenarios

No public PoC is available; the following attack chain is inferred from the vulnerability class and the disclosed id parameter.

1. Reconnaissance / target identification. The attacker identifies a WordPress site running the WP Booking System – Booking Calendar plugin (versions ≤ 2.1.0.3). Fingerprinting can be done via exposed plugin assets or page markup referencing the booking calendar. The attacker then determines whether subscriber self-registration is open, since a low-privileged account is the only prerequisite for exploitation.

2. Triggering the flaw class. After registering or obtaining a subscriber-level account, the attacker sends authenticated requests to the plugin's booking-lookup functionality, manipulating the id parameter to reference booking/event records they do not own. Because the endpoint lacks an authorization check tying the requesting user to the target record (CWE-862), the request is processed and the referenced data is returned.

3. Payload/execution method. At the vulnerability-class level, this is an insecure-direct-object-reference-style enumeration: iterating or guessing id values to harvest private per-event booking descriptions and booking IDs across calendars the attacker has no legitimate claim to. No code execution is involved — the exposure is purely read-based data disclosure.

4. Post-exploitation impact. The attacker obtains private booking descriptions and the associated booking IDs. This data can support further enumeration (using harvested booking IDs to pivot to additional records), privacy violations against customers, competitive intelligence gathering, and social-engineering or phishing campaigns leveraging the disclosed booking context. There is no integrity or availability impact per the CVSS vector.

Impact Assessment

The CVSS:3.1 base score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The vector indicates the attack is network-reachable, requires low attack complexity, needs low (subscriber) privileges and no user interaction, and is scoped to the vulnerable component. Confidentiality impact is High, while Integrity and Availability impacts are None. In business terms, any organization running the affected plugin exposes private customer booking information to any registered user — a meaningful privacy and data-protection concern (e.g., GDPR-relevant personal data in booking descriptions). The blast radius spans every calendar managed by the site, meaning a single low-privileged account can reach data across the entire installation. Because exploitation requires only a cheap account and no public tooling, the barrier to abuse is low once the plugin is identified.

Detection Guidance

Sigma Rule

title: WordPress WP Booking System Booking ID Enumeration by Low-Privilege User
id: 8f3c2b1a-6d4e-4a9b-9c7e-2f1a0b3d5e6c
status: experimental
description: Detects authenticated requests from subscriber-level users targeting the WP Booking System id parameter, consistent with CVE-2026-109368 information exposure.
logsource:
  category: webserver
detection:
  selection_path:
    cs_uri_query|contains:
      - 'id='
  selection_plugin:
    cs_uri_stem|contains:
      - 'wp-booking-system'
      - 'booking-calendar'
  condition: selection_plugin and selection_path
fields:
  - c_ip
  - cs_uri_query
  - sc_status
falsepositives:
  - Legitimate booking views by administrators
  - Plugin asset loads containing unrelated id parameters
level: medium

YARA Rule

rule WP_Booking_System_CVE_2026_109368_Id_Param
{
    meta:
        description = "Detects WP Booking System plugin files referencing the id parameter and booking lookup handler that may be affected by CVE-2026-109368 (missing authorization on id parameter)"
        author = "Threat Intelligence"
        reference = "CVE-2026-109368"
        date = "2026-01-01"
    strings:
        $plugin = "wp-booking-system" ascii nocase
        $calendar = "booking-calendar" ascii nocase
        $idparam = "id" ascii
        $booking = "booking" ascii nocase
    condition:
        filesize < 5MB and
        ($plugin or $calendar) and
        $booking and
        #idparam > 0
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109368 WP Booking System id parameter access (potential info exposure)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"wp-booking-system"; nocase; http.uri; content:"id="; nocase; classtype:attempted-recon; sid:2026109368; rev:1; metadata:affected_product WordPress, cve CVE-2026-109368;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where network.protocol == "http" and
     url.path : ("*wp-booking-system*" or "*booking-calendar*") and
     url.query : "*id=*"]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=iis
| eval uri=coalesce(uri, cs_uri_stem, url)
| eval qs=coalesce(uri_query, cs_uri_query, cs-uri-query)
| where (match(uri, "(?i)wp-booking-system|booking-calendar")) AND match(qs, "(?i)id=")
| stats count min(_time) as first_seen max(_time) as last_seen values(qs) as queries by src_ip
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,CVE-2026-109368,">
  <rule id="2026109368" level="7">
    <decoded_as>web-accesslog</decoded_as>
    <url>wp-booking-system|booking-calendar</url>
    <description>CVE-2026-109368: Possible WP Booking System id parameter information exposure probe</description>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 2/4 (CLAIMED — a single source, NVD, claims a patch; not independently confirmed). Confirm remediation through the vendor before relying on it.

1. Immediate mitigations. Restrict the ability of low-privileged users to reach booking-lookup functionality. Disable open subscriber self-registration where not strictly required, review and prune existing subscriber accounts, and, if feasible, place an authorization-aware WAF rule or reverse proxy rule in front of the plugin to deny booking-detail requests from accounts lacking appropriate capability. Where the plugin or calendar features are not in active use, disable or remove the plugin to eliminate the exposure.
2. Patch/upgrade steps. Because no vendor-confirmed fixed version is published in the supplied data, treat all versions up to and including 2.1.0.3 as vulnerable. Monitor the vendor's release channel and the NVD entry for a confirmed fixed version, and upgrade as soon as one is published. Until then, apply the immediate mitigations above.
3. Long-term hardening. Enforce least-privilege and defense-in-depth on WordPress sites: gate sensitive plugin endpoints behind capability and nonce checks (vendor-side), limit self-registration, monitor for unusual enumeration of the id parameter, and maintain an inventory of installed plugins and their versions to enable rapid response to future advisories. Conduct periodic reviews of third-party plugin authorization logic.

References

• NVD entry for CVE-2026-109368: https://nvd.nist.gov/vuln/detail/CVE-2026-109368
• CWE-862: Missing Authorization — https://cwe.mitre.org/data/definitions/862.html
• FIRST EPSS: not yet scored for this CVE (no EPSS value available)
• CISA KEV: not listed (no known in-the-wild exploitation recorded)
• WordPress plugin security guidance: https://developer.wordpress.org/plugins/security/
• Vendor (WP Booking System) product page: consult the official plugin page for patch status. No public PoC, Nuclei template, or exploit code is available as of this report; there is no evidence of active threat actor campaigns.