CVE-2026-88995— Bookit < 2.6.0.1 - Unauthenticated Appointment PII Disclosure via Availability Check
Quick assessment
Affected
Unknown Bookit — Booking & Appointment Calendar
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 2.6.0.1 之前的 Bookit — Booking & Appointment Calendar（预订与预约日历）WordPress 插件未能对可用性检查请求返回的数据进行适当限制，导致未认证用户可以获取其他客户的预约详情，包括自由文本形式的预订备注和联系信息。
Possible ATT&CK Techniques 1 AI
T1213 · Data from Information Repositories
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-88995
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Bookit < 2.6.0.1 - Unauthenticated Appointment PII Disclosure via Availability Check
Source: CVE Program / CVE List V5
Vulnerability Description
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does not properly restrict the data returned by an availability-check request, allowing unauthenticated users to retrieve other customers' appointment details, including free-text booking comments and contact information.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Bookit — Booking & Appointment Calendar | 0 ~ 2.6.0.1 | - |
|
II. Public POCs for CVE-2026-88995
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-88995
请登录查看更多情报信息。
News Coverage for CVE-2026-88995 (1)
-
🔗 Bookit < 2.6.0.1 – Unauthenticated Appointment PII Disclosure via Availability Check | CVE 2026-88995 | Plugin Vulnerabilities exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-09-13 · 9 CVEs total
| CVE-2026-89080 | Really Simple Security < 9.8.1 - Unauthenticated 2FA Bypass via Email Provider State Demot | |
| CVE-2026-86407 | User Registration & Membership < 5.2.8 - Unauthenticated User Data Disclosure via Membersh | |
| CVE-2026-88764 | Simple Membership < 4.7.8 - Subscriber+ Membership Level Escalation via PayPal Standard su | |
| CVE-2026-88912 | rtMedia for WordPress, BuddyPress and bbPress < 4.7.12 - Subscriber+ Arbitrary Activity Pr | |
| CVE-2026-77773 | Social Contact Form (FormyChat) < 2.15.8 - Unauthenticated Gravity Forms Entry Disclosure | |
| CVE-2026-86406 | User Registration & Membership < 5.2.8 - Subscriber+ Privilege Escalation via Membership P | |
| CVE-2026-80071 | User Registration & Membership < 5.2.8 - Author+ Privilege Escalation to Administrator | |
| CVE-2026-80072 | User Registration & Membership < 5.2.8 - Unauthenticated Open Redirect via Login Redirect |
IV. Related Vulnerabilities
Same vendor: Unknown
-
CVE-2026-89080
Really Simple Security < 9.8.1 - Unauthenticated 2FA Bypass -
CVE-2026-86407
User Registration & Membership < 5.2.8 - Unauthenticated Use -
CVE-2026-88764
Simple Membership < 4.7.8 - Subscriber+ Membership Level Esc -
CVE-2026-88912
rtMedia for WordPress, BuddyPress and bbPress < 4.7.12 - Sub -
CVE-2026-77773
Social Contact Form (FormyChat) < 2.15.8 - Unauthenticated G
V. Comments for CVE-2026-88995
No comments yet