CVE-2025-14982
📋 TL;DR
The Booking Calendar plugin for WordPress has a missing authorization vulnerability that allows authenticated users with Subscriber-level access or higher to view all booking records containing sensitive personal information. This exposes PII including names, email addresses, phone numbers, addresses, payment details, and booking hashes belonging to other users. All WordPress sites using vulnerable versions of this plugin are affected.
💻 Affected Systems
- Booking Calendar WordPress Plugin
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Mass data breach where attackers exfiltrate all booking records containing sensitive PII, leading to identity theft, financial fraud, regulatory penalties, and reputational damage.
Likely Case
Unauthorized viewing of booking records by low-privileged users or compromised accounts, resulting in privacy violations and potential targeted phishing attacks.
If Mitigated
Limited exposure if proper access controls and monitoring are in place, with only minimal data accessed before detection.
🎯 Exploit Status
Exploitation requires authenticated access (Subscriber role or higher). Attack path is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.14.12 or later
Vendor Advisory: https://wordpress.org/plugins/booking/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Booking Calendar plugin. 4. Click 'Update Now' if update available. 5. Alternatively, download latest version from WordPress plugin repository and manually update.
🔧 Temporary Workarounds
Restrict User Registration
allDisable new user registration or require admin approval to limit potential attackers with Subscriber access.
Temporary Plugin Deactivation
allDeactivate Booking Calendar plugin until patched if immediate update not possible.
🧯 If You Can't Patch
- Implement strict access controls and monitor user activity for suspicious booking record access patterns.
- Consider migrating to alternative booking plugins with proper authorization checks while awaiting patch.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for Booking Calendar version. If version is 10.14.11 or lower, system is vulnerable.Check Version:
wp plugin list --name=booking --field=version (if WP-CLI installed)Verify Fix Applied:
Verify Booking Calendar plugin version is 10.14.12 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to booking records by Subscriber-level users
- Multiple booking data queries from single user account
Network Indicators:
- Unusual outbound data transfers containing booking-related data
SIEM Query:
source="wordpress" AND (event="booking_access" OR event="plugin_activity") AND user_role="subscriber" AND data_volume>threshold🔗 References
- https://plugins.trac.wordpress.org/browser/booking/trunk/core/any/class-admin-menu.php#L22
- https://plugins.trac.wordpress.org/browser/booking/trunk/core/wpbc-activation.php#L661
- https://plugins.trac.wordpress.org/browser/booking/trunk/includes/page-bookings/bookings__listing.php#L150
- https://plugins.trac.wordpress.org/browser/booking/trunk/includes/page-bookings/bookings__listing.php#L158
- https://plugins.trac.wordpress.org/browser/booking/trunk/includes/page-bookings/bookings__sql.php#L722
- https://plugins.trac.wordpress.org/browser/booking/trunk/includes/page-bookings/bookings__sql.php#L918
- https://plugins.trac.wordpress.org/changeset?old_path=%2Fbooking&old=3436482&new_path=%2Fbooking&new=3436482&sfp_email=&sfph_mail=
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3432649%40booking%2Ftrunk&old=3416518%40booking%2Ftrunk&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/161d92e3-d255-4967-9449-be263a46bec8?source=cve
