CVE-2026-40774
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The Booking package versions <= 1.7.06 have an issue with unauthenticated access that allows for broken access control.
Risk Assessment
Organizations may be exposed to unauthorized access to sensitive data, potentially leading to data leaks or other serious security incidents.
Recommendation
It is recommended to update the Booking package to the latest version to mitigate this vulnerability.
Other vulnerabilities in Booking Package
See all- CVE-2026-16986Medium
The Booking Package WordPress plugin before version 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected charge from attacker-supplied request values instead, so an unauthenticated attacker can pay an arbitrary fraction of a service's real price.
- CVE-2026-15335High
The Booking Package plugin for WordPress up to version 1.7.20 is vulnerable to generic SQL injection via the 'email' form parameter (form<N>). Insufficient escaping and lack of query preparation allow unauthenticated attackers to append additional SQL queries, potentially extracting sensitive database information.
- CVE-2026-9851High
A vulnerability in the Booking Package plugin for WordPress up to version 1.7.16 allows privilege escalation via account takeover. Missing capability checks in the package_app_action AJAX endpoint let authenticated attackers with Editor-level access or above change the email and password of any account, including administrators.
Original NVD description (English source)
Unauthenticated Broken Access Control in Booking Package <= 1.7.06 versions.