CVE-2026-96886
The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to do
CVSS
—
Sin CVSS
EPSS
0.2%
p10
KEV
—
Exploit Today
3
0-100
Publicado: 30 sept 2026 · Última mod.: 30 sept 2026
0.1%EPSS · 30 días0.2%
2026-09-302026-10-20
The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address and billing address of every customer who has booked a course.
Sin CVEs relacionados por CWE o producto.