Unknown Bookit — Booking & Appointment Calendar vulnerabilities

3 vulnerabilities

Known vulnerabilities in Unknown Bookit — Booking & Appointment Calendar, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

4.3CVE-2026-89007unknownbookit — booking & appointment calendar+1
EPSS score
0.28%
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, allowing users with its low-privileged custom Staff role to delete arbitrary appointments.4.3CVE-2026-89008unknownbookit — booking & appointment calendar+1
EPSS score
0.32%
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on one of its appointment-retrieval actions, allowing users with a low-privilege Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5-specific role to read other users' appointment records, including customer names, email addresses, phone numbers and private booking comments.5.3CVE-2026-88995unknownbookit — booking & appointment calendar+1
EPSS score
0.34%
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does not properly restrict the data returned by an availability-check request, allowing unauthenticated users to retrieve other customers' appointment details, including free-text booking comments and contact information.