{"error":0,"message":null,"data":{"name":"Booking Package","plugin":"booking-package","link":"https:\/\/wordpress.org\/plugins\/booking-package\/","latest":"1793727720","closed":0,"closed_reason":null,"closed_date":null,"vulnerability":[{"uuid":"e6687bda350c3b7d7262797e3ca3a823c6cd704892e06268b0b8b44cc22de7fc","name":"Booking Package [booking-package] < 1.5.11","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.5.11","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2021-20840","name":"CVE-2021-20840","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2021-20840","description":"[en] Cross-site scripting vulnerability in Booking Package - Appointment Booking Calendar System versions prior to 1.5.11 allows a remote attacker to inject an arbitrary script via unspecified vectors.","date":"2021-11-24"},{"id":"JVNDB-2021-000094","name":"WordPress Plugin \"Booking Package - Appointment Booking Calendar System\" vulnerable to cross-site scripting","link":"http:\/\/jvndb.jvn.jp\/jvndb\/JVNDB-2021-000094","description":"WordPress Plugin \"Booking Package - Appointment Booking Calendar System\" provided by Saasproject contains a cross-site scripting vulnerability (CWE-79) due to the flaw in handling some URL query parameters.  Gen Sato of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT\/CC coordinated with the developer under Information Security Early Warning Partnership.","date":"2021-11-10"},{"id":"f68470da79f9fa3f3ee8f09de00148f4146c592d","name":"WordPress Booking Package plugin <= 1.5.10 - Reflected Cross-Site Scripting (XSS) vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/booking-package\/vulnerability\/wordpress-booking-package-plugin-1-5-10-reflected-cross-site-scripting-xss-vulnerability","description":"Reflected Cross-Site Scripting (XSS) vulnerability discovered by Gen Sato (Mitsui Bussan Secure Directions, Inc) in WordPress Booking Package plugin (versions <= 1.5.10).","date":"2021-11-10"},{"id":"e7857e2e-622b-42f2-b197-400523afdeee","name":"Booking Package &lt; 1.5.11 - Reflected Cross-Site Scripting","link":"https:\/\/wpscan.com\/vulnerability\/e7857e2e-622b-42f2-b197-400523afdeee","description":"The plugin does not sanitise user input before outputting it back in the page, leading to a Reflected Cross-Site Scripting","date":null},{"id":"6805af78660a95b78decdd8194f310f6c3143855","name":"Booking Package <= 1.5.10 - Reflected Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/booking-package\/booking-package-1510-reflected-cross-site-scripting","description":"The Booking Package plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.5.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","date":"2021-11-10"},{"id":"EUVD-2021-8252","name":"EUVD-2021-8252","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2021-8252","description":"Malicious code in bioql (PyPI)","date":"2025-10-03"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"6.1","severity":"m","exploitable":"2.8","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"6.1","severity":"medium","av":"network","ac":"low","pr":"none","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"2.8","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"epss":"0.007"}},{"uuid":"b35f9fa098cd505de1c122783790ecb165166a06383e84d706f727ee8c120a05","name":"Booking Package [booking-package] < 1.5.29","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.5.29","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2022-0709","name":"CVE-2022-0709","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2022-0709","description":"[en] The Booking Package WordPress plugin before 1.5.29 requires a token for exporting the ical representation of it's booking calendar, but this token is returned in the json response to unauthenticated users performing a booking, leading to a sensitive data disclosure vulnerability.","date":"2022-04-04"},{"id":"7fde0b00562246efcfc022453071a4d061a0c688","name":"WordPress Booking Package plugin <= 1.5.28 - Unauthenticated Sensitive Data Disclosure vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/booking-package\/vulnerability\/wordpress-booking-package-plugin-1-5-28-unauthenticated-sensitive-data-disclosure-vulnerability","description":"Unauthenticated Sensitive Data Disclosure vulnerability discovered by Huli (Cymetrics) in WordPress Booking Package plugin (versions <= 1.5.28).","date":"2022-03-09"},{"id":"3cd1d8d2-d2a4-45a9-9b5f-c2a56f08be85","name":"Booking Package &lt; 1.5.29 - Unauthenticated Sensitive Data Disclosure","link":"https:\/\/wpscan.com\/vulnerability\/3cd1d8d2-d2a4-45a9-9b5f-c2a56f08be85","description":"The plugin requires a token for exporting the ical representation of it&#039;s booking calendar, but this token is returned in the json response to unauthenticated users performing a booking, leading to a sensitive data disclosure vulnerability.","date":null},{"id":"89422d6fadcb620a55b386ae4384e9c35494e83f","name":"Booking Package <= 1.5.28 - Unauthenticated Sensitive Data Disclosure","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/booking-package\/booking-package-1528-unauthenticated-sensitive-data-disclosure","description":"The Booking Package WordPress plugin before 1.5.29 requires a token for exporting the ical representation of it's booking calendar, but this token is returned in the json response to unauthenticated users performing a booking, leading to a sensitive data disclosure vulnerability.","date":"2022-03-09"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:N\/A:N","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"h","i":"n","a":"n","score":"7.5","severity":"h","exploitable":"3.9","impact":"3.6"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:N\/A:N","score":"7.5","severity":"high","av":"network","ac":"low","pr":"none","ui":"none","s":"unchanged","c":"high","i":"none","a":"none","exploitable":"3.9","impact":"3.6"},"cwe":[{"cwe":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor","description":"The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information."}]}},{"uuid":"23108d1d8cf2c526d2dec9111cf554329e497062145faab5432e2decc201793a","name":"Booking Package [booking-package] < 1.5.99","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.5.99","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"e7eb5243d3af9fd38973f7d59bebc6d698472b0b","name":"Booking Package <= 1.5.98 - Authorization Bypass to Arbitrary Password Reset","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/booking-package\/booking-package-1598-authorization-bypass-to-arbitrary-password-reset","description":"The Booking Package plugin for WordPress is vulnerable to Authorization Bypass in versions up to, and including 1.5.98 due to missing validation in the 'updateUser' function. This allows unauthenticated attackers to reset the email and password of any user on the site if they know the username. Note that only sites that have an active premium subscription are vulnerable.","date":"2023-07-05"},{"id":"CVE-2023-37389","name":"CVE-2023-37389","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-37389","description":"[en] Improper Privilege Management vulnerability in SAASPROJECT Booking Package Booking Package allows Privilege Escalation.This issue affects Booking Package: from n\/a through 1.5.98.","date":"2024-05-17"},{"id":"45b6d8883577d27b3346cd9c910c8282ca836486","name":"WordPress  Booking Package Plugin  <= 1.5.98 is vulnerable to Privilege Escalation","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/booking-package\/vulnerability\/wordpress-booking-package-saasproject-plugin-1-5-98-unauthenticated-privilege-escalation-vulnerability","description":"Update the WordPress Booking Package plugin to the latest available version (at least 1.5.99).\nRafie Muhammad (Patchstack) discovered and reported this Privilege Escalation vulnerability in WordPress Booking Package Plugin. This could allow a malicious actor to escalate their low privileged account to something with higher privileges. After this they could take full control of the website if high privileges are gained. This vulnerability has been fixed in version 1.5.99.","date":"2023-07-10"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:H\/I:H\/A:H","av":"n","ac":"l","pr":"n","ui":"r","s":"u","c":"h","i":"h","a":"h","score":"8.8","severity":"h","exploitable":"2.8","impact":"5.9"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:H\/I:H\/A:H","score":"8.8","severity":"high","av":"network","ac":"low","pr":"none","ui":"required","s":"unchanged","c":"high","i":"high","a":"high","exploitable":"2.8","impact":"5.9"},"cwe":[{"cwe":"CWE-269","name":"Improper Privilege Management","description":"The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","kev":false,"kev_date":null}}},{"uuid":"f7bd8679e735995a488700b1cf71adc263d360896b78c009ea65095d10b6bd56","name":"Booking Package [booking-package] < 1.6.02","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.6.02","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2023-39918","name":"CVE-2023-39918","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-39918","description":"[en] Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in SAASPROJECT Booking Package Booking Package plugin <=\u00a01.6.01 versions.","date":"2023-09-04"},{"id":"51146c56b42cd6bc949393f10eab3e3e2574f376","name":"WordPress  Booking Package Plugin  <= 1.6.01 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/booking-package\/vulnerability\/wordpress-booking-package-plugin-1-6-01-reflected-cross-site-scripting-xss-vulnerability","description":"Update the WordPress Booking Package plugin to the latest available version (at least 1.6.02).\nTruoc Phan discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Booking Package Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site.  This vulnerability has been fixed in version 1.6.02.","date":"2023-08-07"},{"id":"46a7a02d9f13adc37be44935ca5f9e7be00b7be2","name":"Booking Package <= 1.6.01 - Reflected Cross-Site Scripting via 'mode'","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/booking-package\/booking-package-1601-reflected-cross-site-scripting-via-mode","description":"The Booking Package plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mode' parameter in versions up to, and including, 1.6.01 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","date":"2023-08-07"},{"id":"9e4f6d49-cdba-4e55-80e8-3421ffe0cddd","name":"Booking Package &lt; 1.6.02 - Reflected XSS","link":"https:\/\/wpscan.com\/vulnerability\/9e4f6d49-cdba-4e55-80e8-3421ffe0cddd","description":"The plugin does not sanitise and escape the mode parameter before outputting it back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin","date":null}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:L","av":"n","ac":"l","pr":"n","ui":"r","s":"c","c":"l","i":"l","a":"l","score":"7.1","severity":"h","exploitable":"2.8","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:L","score":"7.1","severity":"high","av":"network","ac":"low","pr":"none","ui":"required","s":"changed","c":"low","i":"low","a":"low","exploitable":"2.8","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"6600f4cd07c43513fe0daff6fe49cac5770a24c9a68a9fca5e3871dc72ccb02b","name":"Booking Package [booking-package] < 1.6.29","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.6.29","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-30516","name":"CVE-2024-30516","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-30516","description":"[en] Improper Validation of Specified Quantity in Input vulnerability in SaasProject Booking Package allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Booking Package: from n\/a through 1.6.27.","date":"2026-01-05"},{"id":"36193ac7e87e783f56e052c5a7fce19f6c8acca9","name":"WordPress  Booking Package Plugin    <= 1.6.27 is vulnerable to Other Vulnerability Type","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/booking-package\/vulnerability\/wordpress-booking-package-plugin-1-6-27-price-manipulation-vulnerability","description":"Update the WordPress Booking Package plugin to the latest available version (at least 1.6.29).\nAbdi Pranata discovered and reported this Other Vulnerability Type vulnerability in WordPress Booking Package Plugin.  This vulnerability has been fixed in version 1.6.29.\nThis vulnerability was reported to and published by Patchstack. Our users receive alerts and protections up to 48 hours in advance.\nHave additional information or questions about this entry? Get in touch.","date":null},{"id":"998a630a8bd9a6232d9a3d61777ce68e7ffcd78c","name":"Booking Package <= 1.6.27 - Unauthenticated Price Manipulation","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/booking-package\/booking-package-1627-unauthenticated-price-manipulation","description":"The Booking Package plugin for WordPress is vulnerable to price manipulation in all versions up to, and including, 1.6.27. This is due to insufficient validation on the pricing data being passed to the server. This makes it possible for unauthenticated attackers to modify the price of bookings.","date":"2024-03-28"},{"id":"3baccd11-153e-4223-adc6-0f1aa774edb2","name":"Booking Package &lt; 1.6.29 - Unauthenticated Price Manipulation","link":"https:\/\/wpscan.com\/vulnerability\/3baccd11-153e-4223-adc6-0f1aa774edb2","description":"The Booking Package plugin for WordPress is vulnerable to price manipulation in all versions up to, and including, 1.6.27. This is due to insufficient validation on the pricing data being passed to the server. This makes it possible for unauthenticated attackers to modify the price of bookings.","date":null}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:H\/A:N","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"n","i":"h","a":"n","score":"7.5","severity":"h","exploitable":"3.9","impact":"3.6"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:H\/A:N","score":"7.5","severity":"high","av":"network","ac":"low","pr":"none","ui":"none","s":"unchanged","c":"none","i":"high","a":"none","exploitable":"3.9","impact":"3.6"},"cwe":[{"cwe":"CWE-1284","name":"Improper Validation of Specified Quantity in Input","description":"The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties."}],"ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"012821159e024022f707166d6ffad753bb7aab35cea61b1782b6b368070ca006","name":"Booking Package [booking-package] < 1.6.73","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.6.73","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-13508","name":"CVE-2024-13508","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-13508","description":"[en] The Booking Package plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the locale parameter in all versions up to, and including, 1.6.72 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","date":"2025-02-18"},{"id":"4a47d8507f3048666ae9961d0b524590eebde481","name":"WordPress Booking Package Plugin <= 1.6.72 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/booking-package\/vulnerability\/wordpress-booking-package-plugin-1-6-72-reflected-cross-site-scripting-via-locale-parameter-vulnerability","description":"<p>WordPress Booking Package Plugin <= 1.6.72 is vulnerable to Cross Site Scripting (XSS)<\/p><p>Software: Booking Package<\/p><p>Fixed in version 1.6.73 <\/p><p>Affected Version <= 1.6.72<\/p><p>CVE: CVE-2024-13508<\/p>","date":"2025-02-18"},{"id":"65b909fe3937ca9e4a467fca932c130a698828a8","name":"Booking Package <= 1.6.72 - Reflected Cross-Site Scripting via Locale Parameter","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/booking-package\/booking-package-1672-reflected-cross-site-scripting-via-locale-parameter","description":"The Booking Package plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the locale parameter in all versions up to, and including, 1.6.72 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","date":"2025-02-18"},{"id":"EUVD-2025-4762","name":"EUVD-2025-4762","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2025-4762","description":"The Booking Package plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the locale parameter in all versions up to, and including, 1.6.72 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","date":"2025-02-18"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"6.1","severity":"m","exploitable":"2.8","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"6.1","severity":"medium","av":"network","ac":"low","pr":"none","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"2.8","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null},"epss":"0.002"}},{"uuid":"fab7b6460b1b3797d67b65ea09d51c190b155252c2588fbeab03f66c0919a680","name":"Booking Package [booking-package] < 1.7.07","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.7.07","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-4911","name":"CVE-2026-4911","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-4911","description":"[en] The Booking Package plugin for WordPress is vulnerable to Price Manipulation in versions up to, and including, 1.7.06 This is due to the intentForStripe() function passing user-controlled $_POST['amount'] directly to the Stripe PaymentIntent API without validation, and the commitStripe() function ignoring the server-calculated amount when confirming the payment. While the server correctly calculates the booking cost via getAmount() based on services, guests, taxes, and coupons, this calculated amount is never validated against or used to update the PaymentIntent because the critical code in CreditCard.php that would include the calculated amount in the PaymentIntent update is commented out. This makes it possible for unauthenticated attackers to book services at arbitrary prices (e.g., $0.01 instead of $500.00) by manipulating the amount parameter during PaymentIntent creation and completing the booking with the fraudulent payment.","date":"2026-04-28"},{"id":"aecff65e3f4e4d3e89f06c34ef5880089e8f72bd","name":"Booking Package <= 1.7.06 - Unauthenticated Price Manipulation via 'amount' Parameter","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/booking-package\/booking-package-1706-unauthenticated-price-manipulation-via-amount-parameter","description":"The Booking Package plugin for WordPress is vulnerable to Price Manipulation in versions up to, and including, 1.7.06 This is due to the intentForStripe() function passing user-controlled $_POST['amount'] directly to the Stripe PaymentIntent API without validation, and the commitStripe() function ignoring the server-calculated amount when confirming the payment. While the server correctly calculates the booking cost via getAmount() based on services, guests, taxes, and coupons, this calculated amount is never validated against or used to update the PaymentIntent because the critical code in CreditCard.php that would include the calculated amount in the PaymentIntent update is commented out. This makes it possible for unauthenticated attackers to book services at arbitrary prices (e.g., $0.01 instead of $500.00) by manipulating the amount parameter during PaymentIntent creation and completing the booking with the fraudulent payment.","date":"2026-04-27"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"n","i":"l","a":"n","score":"5.3","severity":"m","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:L\/A:N","score":"5.3","severity":"medium","av":"network","ac":"low","pr":"none","ui":"none","s":"unchanged","c":"none","i":"low","a":"none","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-472","name":"External Control of Assumed-Immutable Web Parameter","description":"The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields."}],"ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"a7f4b5a29c7714f53acff7a6947627d7680e7cd661d804b74370ec422e162991","name":"Booking Package [booking-package] < 1.7.07","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.7.07","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-40774","name":"CVE-2026-40774","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-40774","description":"[en] Unauthenticated Broken Access Control in Booking Package <= 1.7.06 versions.","date":"2026-06-15"},{"id":"482ea220c2e4ec40e1392e459ded011d3f4ad67f","name":"Booking Package <= 1.7.06 - Missing Authorization","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/booking-package\/booking-package-1706-missing-authorization","description":"The Booking Package plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.7.06. This makes it possible for unauthenticated attackers to perform an unauthorized action.","date":"2026-04-21"},{"id":"EUVD-2026-36983","name":"EUVD-2026-36983","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2026-36983","description":"Unauthenticated Broken Access Control in Booking Package <= 1.7.06 versions.","date":"2026-06-15"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:H\/A:N","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"n","i":"h","a":"n","score":"7.5","severity":"h","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:H\/A:N","score":"7.5","severity":"high","av":"network","ac":"low","pr":"none","ui":"none","s":"unchanged","c":"none","i":"high","a":"none","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}],"ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"0fa966a5e3cbed172b94ab707ce12994c6ac6914270eab3e2ebdb43231110e93","name":"Booking Package [booking-package] < 1.7.17","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.7.17","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-9851","name":"CVE-2026-9851","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-9851","description":"[en] The Booking Package plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in versions up to, and including, 1.7.16. This is due to a missing capability check on the 'updateUser' branch of the package_app_action AJAX endpoint, where the handler only validates a nonce and the dispatcher invokes Schedule::updateUser() with the $administrator argument hard-coded to 1, bypassing the only owner-restriction check inside that function and allowing the target user to be determined solely by attacker-supplied input passed directly to wp_update_user(). This makes it possible for authenticated attackers, with Editor-level access and above, to change the email address and password of any account, including Administrator accounts, resulting in a full site takeover.","date":"2026-06-06"},{"id":"3d454bf010b7f9ce02f3b56a7b8da057b38404f6","name":"Booking Package <= 1.7.16 - Authenticated (Editor+) Privilege Escalation via Account Takeover to updateUser AJAX Action","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/booking-package\/booking-package-1716-authenticated-editor-privilege-escalation-via-account-takeover-to-updateuser-ajax-action","description":"The Booking Package plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in versions up to, and including, 1.7.16. This is due to a missing capability check on the 'updateUser' branch of the package_app_action AJAX endpoint, where the handler only validates a nonce and the dispatcher invokes Schedule::updateUser() with the $administrator argument hard-coded to 1, bypassing the only owner-restriction check inside that function and allowing the target user to be determined solely by attacker-supplied input passed directly to wp_update_user(). This makes it possible for authenticated attackers, with Editor-level access and above, to change the email address and password of any account, including Administrator accounts, resulting in a full site takeover.","date":"2026-06-05"},{"id":"EUVD-2026-34961","name":"EUVD-2026-34961","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2026-34961","description":"The Booking Package plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in versions up to, and including, 1.7.16. This is due to a missing capability check on the 'updateUser' branch of the package_app_action AJAX endpoint, where the handler only validates a nonce and the dispatcher invokes Schedule::updateUser() with the $administrator argument hard-coded to 1, bypassing the only owner-restriction check inside that function and allowing the target user to be determined solely by attacker-supplied input passed directly to wp_update_user(). This makes it possible for authenticated attackers, with Editor-level access and above, to change the email address and password of any account, including Administrator accounts, resulting in a full site takeover.","date":"2026-06-06"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:U\/C:H\/I:H\/A:H","av":"n","ac":"l","pr":"h","ui":"n","s":"u","c":"h","i":"h","a":"h","score":"7.2","severity":"h","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:U\/C:H\/I:H\/A:H","score":"7.2","severity":"high","av":"network","ac":"low","pr":"high","ui":"none","s":"unchanged","c":"high","i":"high","a":"high","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-639","name":"Authorization Bypass Through User-Controlled Key","description":"The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","kev":false,"kev_date":null}}},{"uuid":"82821723db27633240895ef0ccd45db3204c880e453daacceddfa36473beab98","name":"Booking Package [booking-package] < 1.7.21","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.7.21","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-15335","name":"CVE-2026-15335","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-15335","description":"[en] The Booking Package plugin for WordPress is vulnerable to generic SQL Injection via 'email' Form Parameter (form<N>) in all versions up to, and including, 1.7.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable REST API endpoint \/wp-json\/booking-package\/v1\/request is registered with permission_callback: __return_true and wp_magic_quotes does not apply to REST-sourced $_POST values, meaning single quotes in the payload reach the SQL sink intact without any authentication requirement. The impact of this is severely limited as the vulnerable parameter goes through is_email.","date":"2026-07-11"},{"id":"fef0c3e2bea2a257813139d54b3a7ecdd316c85a","name":"Booking Package <= 1.7.20 - Unauthenticated SQL Injection via 'email' Form Parameter","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/id\/8bc86a29-cb1f-4711-925c-51dbbf682477","description":"The Booking Package plugin for WordPress is vulnerable to generic SQL Injection via 'email' Form Parameter (form<N>) in all versions up to, and including, 1.7.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable REST API endpoint \/wp-json\/booking-package\/v1\/request is registered with permission_callback: __return_true and wp_magic_quotes does not apply to REST-sourced $_POST values, meaning single quotes in the payload reach the SQL sink intact without any authentication requirement. The impact of this is severely limited as the vulnerable parameter goes through is_email.","date":"2026-07-10"},{"id":"0418652e45e6aefc8654210434f6690af874f250","name":"Booking Package <= 1.7.20 - Unauthenticated SQL Injection via 'email' Form Parameter","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/booking-package\/booking-package-1720-unauthenticated-sql-injection-via-email-form-parameter","description":"The Booking Package plugin for WordPress is vulnerable to generic SQL Injection via 'email' Form Parameter (form<N>) in all versions up to, and including, 1.7.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable REST API endpoint \/wp-json\/booking-package\/v1\/request is registered with permission_callback: __return_true and wp_magic_quotes does not apply to REST-sourced $_POST values, meaning single quotes in the payload reach the SQL sink intact without any authentication requirement. The impact of this is severely limited as the vulnerable parameter goes through is_email.","date":"2026-06-05"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:N\/A:N","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"h","i":"n","a":"n","score":"7.5","severity":"h","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:N\/A:N","score":"7.5","severity":"high","av":"network","ac":"low","pr":"none","ui":"none","s":"unchanged","c":"high","i":"none","a":"none","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","description":"The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data."}],"ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"9112ddaeda22542d97898cc00b3ac31fe2fabd18dd9d53819c9d92a69f74dcec","name":"Booking Package [booking-package] < 1.7.25","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.7.25","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-16986","name":"CVE-2026-16986","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-16986","description":"[en] The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected charge from attacker-supplied request values instead, so an unauthenticated attacker can pay an arbitrary fraction of a service's real price.","date":"2026-08-26"},{"id":"089701c0e877ba0c0e6fa59d3853fe6fc75fc736","name":"Booking Package < 1.7.25 - Unauthenticated Price Manipulation","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/booking-package\/booking-package-1725-unauthenticated-price-manipulation","description":"The Booking Package plugin for WordPress is vulnerable to price manipulation in all versions up to 1.7.25 (exclusive). This makes it possible for unauthenticated attackers to alter the price of bookings.","date":"2026-07-10"}],"impact":{"cwe":[{"cwe":"CWE-284","name":"Improper Access Control","description":"The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor."}],"ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"bc5110dd408dab259f3b7a6efb8484d08435f359facd76fccbeef67d5ae3d33b","name":"Booking Package [booking-package] < 1.7.30","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.7.30","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-105995","name":"CVE-2026-105995","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-105995","description":"[en] The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose other customers' personal information and booking cancellation tokens.","date":"2026-10-10"}],"impact":{"cwe":[{"cwe":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor","description":"The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information."}],"ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"3dd488b7ba0d7e5ccb80758f1ba4b2aeb398ecbe561e70c9b06c8a5a06b04de7","name":"Booking Package [booking-package] < 1.7.30","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.7.30","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-103425","name":"CVE-2026-103425","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-103425","description":"[en] The Booking Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.7.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2026-10-14"},{"id":"86e08a8bf9dfcca184826b05f9a5696f7f115e27","name":"Booking Package <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/booking-package\/booking-package-1729-authenticated-contributor-stored-cross-site-scripting-via-id-shortcode-attribute","description":"The Booking Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.7.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2026-10-13"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"l","ui":"n","s":"c","c":"l","i":"l","a":"n","score":"6.4","severity":"m","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:C\/C:L\/I:L\/A:N","score":"6.4","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"changed","c":"low","i":"low","a":"none","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"f7de239f97e93a1d0e3ee963645c626df45eb782d1473b9da3d854eae9c5525e","name":"Booking Package [booking-package] < 1.7.30","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.7.30","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-103423","name":"CVE-2026-103423","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-103423","description":"[en] The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.29 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve personally identifiable information for every booked customer stored in the booking_package_booked_customers table, including names, email addresses, phone numbers, physical addresses, and cancellation tokens. The nonce nominally protecting the endpoint is a public CSRF token emitted in the localized booking_package JavaScript object on any page rendering the [booking_package] shortcode or widget, making it trivially harvestable by unauthenticated visitors and providing no effective authentication barrier.","date":"2026-10-14"},{"id":"c6cb052e8e20dbbd2139c8f21e1c52697a4ea6bf","name":"Booking Package <= 1.7.29 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'mode=sendBooking' with nonexistent 'timeKey' and 'public=0'","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/booking-package\/booking-package-1729-missing-authorization-to-unauthenticated-sensitive-information-disclosure-via-modesendbooking-with-nonexistent-timekey-and-public0","description":"The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.29 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve personally identifiable information for every booked customer stored in the booking_package_booked_customers table, including names, email addresses, phone numbers, physical addresses, and cancellation tokens. The nonce nominally protecting the endpoint is a public CSRF token emitted in the localized booking_package JavaScript object on any page rendering the [booking_package] shortcode or widget, making it trivially harvestable by unauthenticated visitors and providing no effective authentication barrier.","date":"2026-10-13"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:N\/A:N","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"h","i":"n","a":"n","score":"7.5","severity":"h","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:N\/A:N","score":"7.5","severity":"high","av":"network","ac":"low","pr":"none","ui":"none","s":"unchanged","c":"high","i":"none","a":"none","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}]}},{"uuid":"db59a859e42a774ba5ae641c1dd398d782da1c5e25b8ed2130ee0265f85bf3b1","name":"Booking Package [booking-package] < 1.7.31","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.7.31","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-105999","name":"CVE-2026-105999","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-105999","description":"[en] The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administrator's notification email addresses.","date":"2026-10-21"},{"id":"ac7e8285e5fa169ab01accd499b34a36e2bdc1f8","name":"Booking Package <= 1.7.30 - Unauthenticated Information Exposure","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/booking-package\/booking-package-1730-unauthenticated-information-exposure","description":"The Booking Package plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.30. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.","date":"2026-10-21"}],"impact":{"cwe":[{"cwe":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor","description":"The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information."}],"ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"fbe411dc65dcd1efe15802cdaf3c2dcf19000df571e195fad2b96247dc060475","name":"Booking Package [booking-package] < 1.7.31","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.7.31","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-105998","name":"CVE-2026-105998","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-105998","description":"[en] The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features.","date":"2026-10-21"},{"id":"20c36fb8825b578534ad19d8fe2ff746e6f210e6","name":"Booking Package <= 1.7.30 - Missing Authorization","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/booking-package\/booking-package-1730-missing-authorization","description":"The Booking Package plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.7.30. This is due to a missing capability check on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action.","date":"2026-10-21"}],"impact":{"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}],"ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"45df6f7c928ef731ff7d07d0c57246cfde2cb7ece499ba9d3e41427d980601a8","name":"Booking Package [booking-package] < 1.7.31","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.7.31","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-105996","name":"CVE-2026-105996","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-105996","description":"[en] The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source of randomness, deriving them instead from values it exposes publicly, so an unauthenticated attacker can reconstruct an arbitrary booking's token, disclose that booking's personal data and, where visitor cancellation is enabled, cancel the booking.","date":"2026-10-21"},{"id":"910de181b15afe6679a308c5441417da3ae4a28a","name":"Booking Package < 1.7.31 - Unauthenticated Information Exposure","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/booking-package\/booking-package-1731-unauthenticated-information-exposure","description":"The Booking Package plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to 1.7.31. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.","date":"2026-10-19"}],"impact":{"cwe":[{"cwe":"CWE-326","name":"Inadequate Encryption Strength","description":"The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"1d68ef183906c9d1b373ac3057c15174f2d699b5a98a01a90948cb64ca4f160d","name":"Booking Package [booking-package] < 1.7.33","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.7.33","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-105997","name":"CVE-2026-105997","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-105997","description":"[en] The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recipient to server-side state, allowing unauthenticated users to make the site send templated verification-code emails to arbitrary recipients.","date":"2026-10-28"},{"id":"4666ce87665bb2cba2ba3bedfe0bcdd4dea07eac","name":"Booking Package < 1.7.33 - Missing Authorization","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/booking-package\/booking-package-1733-missing-authorization","description":"The Booking Package plugin for WordPress is vulnerable to unauthorized access in all versions up to 1.7.33. This is due to a missing capability check on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action.","date":"2026-10-21"}],"impact":{"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}],"ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","kev":false,"kev_date":null}}}]},"updated":"1793253806"}