The WP Booking System – Booking Calendar plugin contains an authorization bypass that allows the contents of all booking notification emails to be read without proper permission checks. Attackers can enumerate booking identifiers and email log identifiers to retrieve sensitive customer information such as names, email addresses, phone numbers, messages, and booking dates, compromising personal data confidentiality.

The vulnerability affects all installations of the WP Booking System – Booking Calendar plugin for WordPress up to and including version 2.1.0.3. The issue is present in the core plugin code and does not depend on external services or modules.

The CVSS score of 7.5 indicates a moderate‑to‑high severity. The EPSS score is currently not available, and the flaw is not listed in the CISA KEV catalog. Attack delivery can occur simply by issuing an HTTP request to the wp-admin page that contains the wpbs_action=email_logs parameter. Because the vulnerability can be triggered by any authenticated Subscriber‑role user—who can access the wp-admin profile page—the exploitation barrier is very low. Without remediation, an attacker could sequentially iterate through booking and email identifiers to expose the full set of customer data for an entire site.