Vulnerabilidad · Publicado 17/10/2026
El plugin WP Booking System – Booking Calendar versiones hasta 2.1.0.3 contiene una falla de autorización que permite a atacantes no autenticados acceder a datos sensibles de notificaciones de reservas. Un adversario puede iterar parámetros de booking_id y email_log_id para extraer cuerpos de correos electrónicos almacenados. Esta vulnerabilidad afecta directamente a agencias de viajes, hoteles y plataformas de reserva en México y LATAM que dependen de este plugin para gestionar datos de clientes.
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read the stored notification email body of any booking by iterating booking_id and email_log_id, exposing customer PII including names, email addresses, phone numbers, messages, and booking dates intended to be visible only to administrators. This is exploitable by any Subscriber-level user because admin_init fires on profile.php, a wp-admin page accessible to all authenticated users.
Score: 7.5/10 — Severidad: HIGH — Estado NIST: Received
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-862
Publicado en NIST NVD.