medium5.3
CVE-2026-88995
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does not properly restrict the data returned by an availability-check request, allo…
Impact
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does not properly restrict the data returned by an availability-check request, allowing unauthenticated users to retrieve other customers' appointment details, including free-text booking comments and contact information.
Affected products
| Product | Affected versions |
|---|---|
| Bookit — Booking & Appointment Calendar WordPress Plugin | before 2.6.0.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.