What is GHSA-h8fj-8c8p-pcww?

GHSA-h8fj-8c8p-pcww is a security advisory published by GitHub Security Advisories with Medium severity. The Bookit — Booking \u0026 Appointment Calendar WordPress plugin before 2.6.0.1 does not properly...

Which CVE IDs does GHSA-h8fj-8c8p-pcww cover?

GHSA-h8fj-8c8p-pcww covers the following CVE IDs: CVE-2026-88995. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-h8fj-8c8p-pcww?

GHSA-h8fj-8c8p-pcww has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-h8fj-8c8p-pcwwMediumCVSS 5.3

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does not properly...

Vendor

GitHub Security Advisories

Published

September 13, 2026

Last Modified

September 13, 2026

🔗 CVE IDs covered (1)

CVE-2026-88995 →

📋 Description

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does not properly restrict the data returned by an availability-check request, allowing unauthenticated users to retrieve other customers' appointment details, including free-text booking comments and contact information.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-88995
https://wpscan.com/vulnerability/5a6f6d75-e7b8-44ad-a0f6-f6e4938ac3d5
https://github.com/advisories/GHSA-h8fj-8c8p-pcww