What the vulnerability does
01Description
The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 10.14.10 via the `WPBC_FLEXTIMELINE_NAV` AJAX action. This is due to the nonce verification being conditionally disabled by default (`booking_is_nonce_at_front_end` option is `'Off'` by default). When the `booking_is_show_popover_in_timeline_front_end` option is enabled (which is the default in demo installations and can be enabled by administrators), it is possible for unauthenticated attackers to extract sensitive booking data including customer names, email addresses, phone numbers, and booking details.
Explanation of Vulnerability in Simple Terms
02Summary
Booking Calendar versions up to 10.14.10 fail to properly check user permissions before allowing access to certain functions. An unauthenticated attacker can read limited information from the plugin without authorization. Update to a version newer than 10.14.10 to resolve this issue.
What an attacker can do
03Attacker Capabilities
Read limited data from the plugin without logging in.
Potential impact on your site
04Site Impact
Sensitive booking or calendar data may be exposed to unauthenticated visitors.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication or user interaction required.
Key dates
06Disclosure timeline
January 9, 2026
CVE published
April 8, 2026
Record updated
