CVE-2026-96886

MediumCVSS 5.3/10Last modified Sep 30, 2026

Description

The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address and billing address of every customer who has booked a course.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Sep 30, 2026
Last modified
Sep 30, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-968887.5A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while proCVE-2026-968897.8A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarationsCVE-2026-96894.2A flaw was found in Keycloak, an open-source identity and access management solution. When a client application is configured to accept broaCVE-2026-968908.8A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to causeCVE-2026-968919.8A vulnerability was identified in D-Link DIR-825 3.00b32. Affected is the function tunnel_set_params of the file tunnel.c of the component rCVE-2026-968924.3A flaw has been found in Edimax BR-6428nC 1.16. The impacted element is the function websRedirect of the component goform Handler. ExecutingCVE-2026-968937.3GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that,CVE-2026-968956.8The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before outputting them in an HTMLCVE-2026-968967.2The Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin before 19.9.7 does not perform an authorisation check on one of its ACVE-2026-968975.3The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available tCVE-2026-968987.3A vulnerability was detected in yhx070424 ShopXO up to 2.2.7. Affected by this vulnerability is an unknown functionality of the file config/CVE-2026-968996.8The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints
CVE-2026-96886: Medium severity, CVSS 5.3 | Vulnix