CVE-2026-96886

{
  "etk_id": "ETK-2026-510",
  "cve_id": "CVE-2026-96886",
  "display_id": "CVE-2026-96886",
  "ghsa_id": "GHSA-xm8x-c5rq-f7r4",
  "euvd_id": "EUVD-2026-89626",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated booking export data exposure in Course Booking System",
  "summary": "Course Booking System WordPress plugin versions before 7.0.9 expose the booking export without authentication. An unauthenticated attacker can download customer names, email addresses, and billing addresses for course bookings. The issue affects sites with the plugin installed at a version earlier than 7.0.9.",
  "mitigation": "Upgrade Course Booking System to version 7.0.9 or later. Restrict public access to the affected WordPress site until the update is applied.",
  "vendor": null,
  "product": "Course Booking System",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 7.0, < 7.0.9"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "7.0.9"
      ],
      "package_name": "Course Booking System",
      "purl": null
    }
  ],
  "cwes": [
    200
  ],
  "cvss_score": 5.3,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "epss_score": 0.0021,
  "epss_percentile": 0.1005,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 91.2602785,
  "t0_at": "2026-09-30T06:00:26.004000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-09-30T06:00:26.004000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-30T06:00:26.004000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96886"
    }
  }
}