The Course Booking System WordPress plugin before version 7.0.9 allows unauthenticated users to download a CSV that contains the full name, email address and billing address of every customer who has booked a course. This flaw permits a wide‑scale disclosure of personally identifiable information (PII) without any authentication or authorization controls, matching CWE-200 and CWE-284 weaknesses. The integrity of the booking data is maintained, but confidentiality is severely compromised.

The affected product is the Course Booking System version 7.0.9 and earlier. No specific vendor name is listed, but users running this plugin on any WordPress installation fall within the risk scope.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, yet it enables data leakage to any Internet‑connected user. Attackers can trigger the export simply by accessing the public export URL. The likely attack vector is an unauthenticated HTTP request to this endpoint. Because authentication is not required, the threat surface is large, and the confidentiality impact is potentially significant.