The Booking Calendar plugin for WordPress contains a vulnerability that allows unauthenticated users to expose private booking data. The flaw exists in the WPBC_FLEXTIMELINE_NAV AJAX action and is caused by a nonce check that is disabled by default when the booking_is_nonce_at_front_end option is set to Off. When the booking_is_show_popover_in_timeline_front_end option is enabled, which is the default on demo setups, attackers can retrieve customer names, email addresses, phone numbers, and other booking details without needing credentials.

The issue affects all installations of the wpdevelop Booking Calendar plugin up to and including version 10.14.10. Any WordPress site running a vulnerable version is at risk.

The CVSS score of 5.3 indicates a moderate severity of the defect, and an EPSS score of less than 1% reflects a very low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw by sending an AJAX request to the WPBC_FLEXTIMELINE_NAV endpoint, bypassing authentication due to the disabled nonce verification, and sequentially harvesting sensitive booking records.