CVE-2026-105997

The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recipient to server-side state, allowing unauthenticated users to make the site send templated verification-code emails to arbitrary recipients...

CVE-2026-105997 Booking Package < 1.7.33 - Unauthenticated Verification Email Sending to Arbitrary Recipient

The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recipient to server-side state, allowing unauthenticated users to make the site send templated verification-code emails to arbitrary recipients...

CVE-2026-105997

The Booking Package WordPress plugin, in versions prior to 1.7.33 , is vulnerable to an issue where it fails to restrict who can trigger booking verification-code emails. Because the plugin does not bind the recipient to a server-side state, unauthenticated users can force the site to send templa...

EUVD-2026-111702

The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recipient to server-side state, allowing unauthenticated users to make the site send templated verification-code emails to arbitrary recipients...

WordPress Booking Package plugin < 1.7.33 - Unauthenticated Verification Email Sending to Arbitrary Recipient vulnerability

Unauthenticated Verification Email Sending to Arbitrary Recipient vulnerability discovered by Pedro Pinho in WordPress Plugin Booking Package versions 1.7.33...

PT-2026-127819

The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recipient to server-side state, allowing unauthenticated users to make the site send templated verification-code emails to arbitrary recipients...

CVE-2026-105996

The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source of randomness, deriving them instead from values it exposes publicly, so an unauthenticated attacker can reconstruct an arbitrary booking's token, disclose that booking's persona...

CVE-2026-105998

The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features...

CVE-2026-105999

The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administrator's notification email addresses...

CVE-2026-105999 Booking Package < 1.7.31 - Unauthenticated Calendar Account Information Disclosure

The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administrator's notification email addresses...

CVE-2026-105999

The Booking Package WordPress plugin in versions prior to 1.7.31 contains an unauthenticated calendar account information disclosure vulnerability. The root cause is a failure to perform proper authorization checks before returning calendar-account configurations in a response. This allows unauth...

EUVD-2026-107056

The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administrator's notification email addresses...

WordPress Booking Package plugin < 1.7.31 - Unauthenticated Calendar Account Information Disclosure vulnerability

Unauthenticated Calendar Account Information Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Booking Package versions 1.7.31...

CVE-2026-105999 Booking Package < 1.7.31 - Unauthenticated Calendar Account Information Disclosure

The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administrator's notification email addresses...

CVE-2026-105998 Booking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing Authorization

The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features...

EUVD-2026-107055

The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features...

EUVD-2026-107054

The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source of randomness, deriving them instead from values it exposes publicly, so an unauthenticated attacker can reconstruct an arbitrary booking's token, disclose that booking's persona...

WordPress Booking Package plugin < 1.7.31 - Unauthenticated Subscription Deactivation vulnerability

Unauthenticated Subscription Deactivation vulnerability discovered by Md. Minaruzzaman Shovon in WordPress Plugin Booking Package versions 1.7.31...

CVE-2026-105998 Booking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing Authorization

The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features...

WordPress Booking Package plugin < 1.7.31 - Unauthenticated Booking PII Disclosure and Cancellation vulnerability

Unauthenticated Booking PII Disclosure and Cancellation vulnerability discovered by Emiliano Carrizo in WordPress Plugin Booking Package versions 1.7.31...