Bookit < 2.6.0.5 – Bookit Staff+ Appointment PII Disclosure | CVE 2026-89008

Description

The plugin does not perform an authorization check on one of its appointment-retrieval actions, allowing users with a low-privilege plugin-specific role to read other users' appointment records, including customer names, email addresses, phone numbers and private booking comments.

Proof of Concept

The bookit_get_calendar_appointments AJAX action verifies only a nonce and performs no capability or ownership check, so any user who can load the plugin's Staff admin screen can read every appointment's customer PII.

Environment preparation:
1. As an administrator, add a staff member (BookIt Calendar > Staff > Add Staff). This creates a WordPress user in the plugin's "Bookit Staff" role, which cannot access any BookIt admin screen except Staff.
2. Ensure at least one appointment exists for a DIFFERENT staff member (book one from the front-end booking form), so there is other-staff data to read.

Steps (as the low-privilege staff user):
1. Log in and open the Staff screen:
   https://victim.example/wp-admin/admin.php?page=bookit-staff
2. In the page source, read the calendar nonce from the inline bookit_window object:
   "bookit_get_calendar_appointments":"<NONCE>"
3. Call the action for a wide date range:

   curl -s -b cookies.txt "https://victim.example/wp-admin/admin-ajax.php?action=bookit_get_calendar_appointments" \
     --data-urlencode "action=bookit_get_calendar_appointments" \
     --data-urlencode "nonce=<NONCE>" \
     --data-urlencode "start_timestamp=1789344000" \
     --data-urlencode "end_timestamp=1789516800" \
     --data-urlencode "is_detail=1"

Result: the response returns every appointment in the range, each including customer_name, customer_email, customer_phone and the private booking comment, regardless of which staff member the appointment belongs to.

Control: the same request with no session returns the string "0" (HTTP 400), because the action is not registered for unauthenticated users.