Executive brief
The Bookit WordPress plugin is a booking and appointment calendar system used by businesses to manage customer reservations. A flaw in the plugin's availability-check feature allows unauthenticated visitors to retrieve other customers' sensitive appointment information, including names, email addresses, phone numbers, and booking comments, by exploiting an improperly validated API endpoint.
Technical details
The vulnerability is a sensitive data disclosure (CWE-200) caused by improper access controls on the bookit_day_appointments AJAX action. An unauthenticated attacker can extract a nonce value from the public booking page, then use it to POST requests to admin-ajax.php with varying date_timestamp parameters to enumerate appointment records across any date range. The plugin returns full appointment rows including serialized customer notes containing personal identifiers (name, email, phone) and free-text comments. No authentication is required; the attack relies only on knowledge of the plugin's nonce mechanism and a brute-force date sweep. The vulnerability was fixed in version 2.6.0.1, which now restricts returned data to only id, staff_id, start_time, end_time, and status fields.
Affected products
- Bookit Bookit — Booking & Appointment Calendar before 2.6.0.1
Timeline
- 2026-09-11: disclosed
- 2026-09-13: advisory
- 2026-09-11: patched: Fixed in version 2.6.0.1