CVE-2026-89008

Name of the Vulnerable Software and Affected Versions Bookit — Booking & Appointment Calendar WordPress plugin versions prior to 2.6.0.5

Description An authorization check is missing in an appointment-retrieval action. This allows users with a low-privilege role specific to the plugin to access appointment records of other users, leading to the disclosure of personally identifiable information such as customer names, email addresses, phone numbers, and private booking comments.

Recommendations Update to version 2.6.0.5 or later.