CVE-2026-108123Published
WP Booking System <= 2.1.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'wpbs_action=email_logs' Action
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-108123 · Microsoft / collected KEV context
cve-program · CVE-2026-108123
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a86fab4a-71ec-4006-96f0-46202de2f389?source=cve
- https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.2/includes/base/admin/booking/functions.php#L250
- https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.2/includes/base/admin/functions.php#L30
- https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.2/includes/base/admin/booking/functions.php#L244
- https://plugins.trac.wordpress.org/browser/wp-booking-system/trunk/includes/base/admin/booking/functions.php
- https://plugins.trac.wordpress.org/changeset/3750085/wp-booking-system/trunk/includes/base/admin/booking/functions.php
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.