CVE-2026-105995
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose other customers' personal information and booking cancellation tokens.
Risk Assessment
Unauthenticated users can access sensitive customer personal data and cancellation tokens, potentially leading to privacy breaches and business disruption.
Recommendation
Update the Booking Package plugin to version 1.7.30 or later, which includes the security fix.
Other vulnerabilities in Booking Package
See all- CVE-2026-16986Medium
The Booking Package WordPress plugin before version 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected charge from attacker-supplied request values instead, so an unauthenticated attacker can pay an arbitrary fraction of a service's real price.
- CVE-2026-15335High
The Booking Package plugin for WordPress up to version 1.7.20 is vulnerable to generic SQL injection via the 'email' form parameter (form<N>). Insufficient escaping and lack of query preparation allow unauthenticated attackers to append additional SQL queries, potentially extracting sensitive database information.
- CVE-2026-40774High
The Booking package versions <= 1.7.06 have an issue with unauthenticated access that allows for broken access control.
- CVE-2026-9851High
A vulnerability in the Booking Package plugin for WordPress up to version 1.7.16 allows privilege escalation via account takeover. Missing capability checks in the package_app_action AJAX endpoint let authenticated attackers with Editor-level access or above change the email and password of any account, including administrators.
Original NVD description (English source)
The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose other customers' personal information and booking cancellation tokens.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS