The WP Booking System – Booking Calendar plugin contains a missing authorization check in the wpbs_refresh_calendar_editor AJAX endpoint. The flaw allows any authenticated user who has the subscriber role or higher to submit an event identifier and obtain the corresponding private booking description and booking ID. This data is considered sensitive as it reveals details about individual reservations that were intended for administrative review only.

All installations of WP Booking System – Booking Calendar version 2.1.0.3 or earlier are affected. Any WordPress site that has not upgraded past 2.1.0.3 and continues to serve the wpbs_refresh_calendar_editor action is susceptible, regardless of the number of users or the size of the event calendar.

The reported CVSS score is 6.5, indicating a medium severity vulnerability. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. Because the attack requires only standard subscriber‑level authentication, which many sites offer to a broad user base, the practical risk is that any user with a legitimate account can extract private booking data by simply accessing the vulnerable AJAX endpoint. lack of a denial‑of‑service component keeps the main concern strictly confidentiality exposure.