The Booking Package WordPress plugin prior to version 1.7.31 returns calendar‑account configuration data without enforcing any authorization checks. This flaw exposes sensitive settings, including the administrator’s notification email addresses, to anyone who can query the endpoint. The exposure of personal contact information poses a confidentiality risk and, if leveraged, could facilitate targeted phishing or credential‑based attacks – an inference drawn from the nature of the exposed data.

All installations of the Booking Package WordPress plugin running any version older than 1.7.31 are susceptible. The vendor is unknown, but the product is identified as the Booking Package plugin for WordPress. No specific WordPress core version is mentioned; the vulnerability applies to any site that has not migrated to the stated patched release.

Authentication is not required to trigger the disclosure, so the attack surface is broad and the exploit path trivial. The CVSS score of 5.3 reflects moderate severity for the information exposure. The EPSS score of less than 1% indicates a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog, but its potential impact on site administrators warrants prompt attention.