What is GHSA-xm8x-c5rq-f7r4?

GHSA-xm8x-c5rq-f7r4 is a security advisory published by GitHub Security Advisories with Medium severity. The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking...

Which CVE IDs does GHSA-xm8x-c5rq-f7r4 cover?

GHSA-xm8x-c5rq-f7r4 covers the following CVE IDs: CVE-2026-96886. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xm8x-c5rq-f7r4?

GHSA-xm8x-c5rq-f7r4 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-xm8x-c5rq-f7r4MediumCVSS 5.3

The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking...

Vendor

GitHub Security Advisories

Published

September 30, 2026

Last Modified

September 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-96886 →

📋 Description

The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address and billing address of every customer who has booked a course.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-96886
https://wpscan.com/vulnerability/bdf459bb-7835-43d3-8ef8-83b3b099677a
https://github.com/advisories/GHSA-xm8x-c5rq-f7r4