CVE-2026-103423
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.7.29. Unauthenticated attackers can retrieve personally identifiable information for every booked customer, including names, email addresses, phone numbers, and physical addresses.
Risk Assessment
Attackers can obtain sensitive personal data of customers, violating privacy and potentially leading to identity theft or other abuses.
Recommendation
Immediately update the Booking Package plugin to the latest version that includes a security fix for the authorization bypass.
Other vulnerabilities in Booking Package
See all- CVE-2026-105995Medium
The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose other customers' personal information and booking cancellation tokens.
- CVE-2026-16986Medium
The Booking Package WordPress plugin before version 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected charge from attacker-supplied request values instead, so an unauthenticated attacker can pay an arbitrary fraction of a service's real price.
- CVE-2026-15335High
The Booking Package plugin for WordPress up to version 1.7.20 is vulnerable to generic SQL injection via the 'email' form parameter (form<N>). Insufficient escaping and lack of query preparation allow unauthenticated attackers to append additional SQL queries, potentially extracting sensitive database information.
- CVE-2026-40774High
The Booking package versions <= 1.7.06 have an issue with unauthenticated access that allows for broken access control.
- CVE-2026-9851High
A vulnerability in the Booking Package plugin for WordPress up to version 1.7.16 allows privilege escalation via account takeover. Missing capability checks in the package_app_action AJAX endpoint let authenticated attackers with Editor-level access or above change the email and password of any account, including administrators.
Original NVD description (English source)
The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.29 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve personally identifiable information for every booked customer stored in the booking_package_booked_customers table, including names, email addresses, phone numbers, physical addresses, and cancellation tokens. The nonce nominally protecting the endpoint is a public CSRF token emitted in the localized booking_package JavaScript object on any page rendering the [booking_package] shortcode or widget, making it trivially harvestable by unauthenticated visitors and providing no effective authentication barrier.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS