The Booking Calendar plugin for WordPress suffers from a missing authorization check that allows authenticated users with Subscriber-level role or higher to view all booking records stored in the database. The exposed data includes personally identifiable information such as names, e‑mails, phone numbers, physical addresses, payment status, booking costs and booking hashes. Because the flaw can be triggered through normal plugin functionality, an attacker who can log in can harvest sensitive data across all bookings on the site.

This vulnerability affects all released versions of Booking Calendar up to and including version 10.14.11. The plugin, published by wpdevelop, is used in any WordPress installation that has installed this plugin. No specific sub‑version or patch is listed; the issue exists in all revisions prior to 10.14.12.

The CVSS score of 4.3 indicates moderate risk, and the EPSS score of less than 1% shows a very low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The attack vector is primarily through normal logged‑in use; any authenticated user with Subscriber role or higher can trigger the flaw. Therefore, sites with many subscriber accounts face a significant risk of data exposure if the plugin is not updated.