CVE-2026-105996 Booking Package < 1.7.31 - Unauthenticated Booking PII Disclosure and Cancellation via Predictable Token

The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source of randomness, deriving them instead from values it exposes publicly, so an unauthenticated attacker can reconstruct an arbitrary booking's token, disclose that booking's persona...