# WP Booking System <= 2.1.0.3 - Unauthenticated Missing Authorization to Booking Email Log Disclosure and Resend

- **ID:** WPSEC-2026-1183
- **Plugin:** WP Booking System – Booking Calendar (`wp-booking-system`), https://wordpress.org/plugins/wp-booking-system/
- **Affected versions:** all versions before 2.1.0.4
- **Fixed in:** 2.1.0.4 (Update to 2.1.0.4 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-17)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-booking-system
- **Fix released:** 2026-10-16
- **Published:** 2026-10-17
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1183/

## Description

The WP Booking System plugin for WordPress is vulnerable to unauthorized access and modification of data via the 'email_logs' and 'resend_email' wpbs_action handlers in all versions up to, and including, 2.1.0.3, due to missing authorization checks. The handlers run on admin_init and take a user-controlled 'booking_id' and 'email_log_id', but they do not check that the requester is logged in or can access the booking's calendar. This makes it possible for unauthenticated attackers to read the stored bodies of booking emails, which may contain customers' personal data, and to resend those emails for arbitrary bookings.

## References

- https://wpsec.com/vuln/WPSEC-2026-1183/
- https://plugins.svn.wordpress.org/wp-booking-system/tags/2.1.0.4/
- https://wordpress.org/plugins/wp-booking-system/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1183/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.