Logo
Retour à la veille

CVE-2026-109368

Publié : 17 octobre 2026
Modifié : 17 octobre 2026
Lien officiel NVD
Score CVSS
6.5
MEDIUM

Description détaillée

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.0.3 via the 'id' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract private per-event booking descriptions and booking IDs from any calendar managed by the site.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Références et Patchs

https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.2/includes/base/admin/calendar/class-calendar-editor-outputter.php#L432https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.2/includes/base/admin/calendar/class-calendar-editor-outputter.php#L484https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.2/includes/base/admin/calendar/functions-actions-ajax-calendar.php#L12https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.2/includes/base/admin/calendar/functions-actions-ajax-calendar.php#L62https://plugins.trac.wordpress.org/changeset/3750120/wp-booking-system/trunk/includes/base/admin/calendar/functions-actions-ajax-calendar.phphttps://plugins.trac.wordpress.org/changeset?old=3730163&old_path=%2Fwp-booking-system%2Ftrunk&new=&new_path=%2Fwp-booking-system%2Ftrunkhttps://www.wordfence.com/threat-intel/vulnerabilities/id/164a276a-612f-416f-b9ef-1c2e6dd0e8e4?source=cve

Dernières Vulnérabilités

CVE-2026-110384

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Fancy Comments WordPress fancy-facebook-comments allows Reflected XSS.This issue affects Fancy Comments WordPress: from n/a through 1.2.21.

VOIR DÉTAILS

CVE-2026-97314

The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthenticated attackers to disclose the destination URLs of unpublished affiliate links and to record fabricated click statistics.

VOIR DÉTAILS

CVE-2026-92433

The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing attackers to make a logged-in administrator re-link the integration to an attacker-controlled account via a crafted request (CSRF), taking over the site's Patreon integration.

VOIR DÉTAILS