CVE-2026-108123

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to an authorization bypass in versions up to and including 2.1.0.3 . The root cause is a failure to properly verify user authorization for specific actions, specifically the wpbs_action=email_logs action. This allows unau...