FKIE_CVE-2025-14982
Vulnerability from fkie_nvd - Published: 2026-01-16 05:16 - Updated: 2026-04-15 00:35
Severity ?
Summary
The Booking Calendar plugin for WordPress is vulnerable to Missing Authorization leading to Sensitive Information Exposure in all versions up to, and including, 10.14.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view all booking records in the database, including personally identifiable information (PII) such as names, email addresses, phone numbers, physical addresses, payment status, booking costs, and booking hashes belonging to other users.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Booking Calendar plugin for WordPress is vulnerable to Missing Authorization leading to Sensitive Information Exposure in all versions up to, and including, 10.14.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view all booking records in the database, including personally identifiable information (PII) such as names, email addresses, phone numbers, physical addresses, payment status, booking costs, and booking hashes belonging to other users."
},
{
"lang": "es",
"value": "El plugin Booking Calendar para WordPress es vulnerable a una falta de autorizaci\u00f3n, lo que lleva a la exposici\u00f3n de informaci\u00f3n sensible en todas las versiones hasta la 10.14.11, inclusive. Esto permite a atacantes autenticados, con acceso de nivel Suscriptor y superior, ver todos los registros de reservas en la base de datos, incluyendo informaci\u00f3n de identificaci\u00f3n personal (PII) como nombres, direcciones de correo electr\u00f3nico, n\u00fameros de tel\u00e9fono, direcciones f\u00edsicas, estado de pago, costos de reserva y hashes de reserva pertenecientes a otros usuarios."
}
],
"id": "CVE-2025-14982",
"lastModified": "2026-04-15T00:35:42.020",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "security@wordfence.com",
"type": "Secondary"
}
]
},
"published": "2026-01-16T05:16:12.483",
"references": [
{
"source": "security@wordfence.com",
"url": "https://plugins.trac.wordpress.org/browser/booking/trunk/core/any/class-admin-menu.php#L22"
},
{
"source": "security@wordfence.com",
"url": "https://plugins.trac.wordpress.org/browser/booking/trunk/core/wpbc-activation.php#L661"
},
{
"source": "security@wordfence.com",
"url": "https://plugins.trac.wordpress.org/browser/booking/trunk/includes/page-bookings/bookings__listing.php#L150"
},
{
"source": "security@wordfence.com",
"url": "https://plugins.trac.wordpress.org/browser/booking/trunk/includes/page-bookings/bookings__listing.php#L158"
},
{
"source": "security@wordfence.com",
"url": "https://plugins.trac.wordpress.org/browser/booking/trunk/includes/page-bookings/bookings__sql.php#L722"
},
{
"source": "security@wordfence.com",
"url": "https://plugins.trac.wordpress.org/browser/booking/trunk/includes/page-bookings/bookings__sql.php#L918"
},
{
"source": "security@wordfence.com",
"url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fbooking\u0026old=3436482\u0026new_path=%2Fbooking\u0026new=3436482\u0026sfp_email=\u0026sfph_mail="
},
{
"source": "security@wordfence.com",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3432649%40booking%2Ftrunk\u0026old=3416518%40booking%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
},
{
"source": "security@wordfence.com",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/161d92e3-d255-4967-9449-be263a46bec8?source=cve"
}
],
"sourceIdentifier": "security@wordfence.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-862"
}
],
"source": "security@wordfence.com",
"type": "Secondary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…