CVE-2026-105997

The Booking Package WordPress plugin, in versions prior to 1.7.33 , is vulnerable to an issue where it fails to restrict who can trigger booking verification-code emails. Because the plugin does not bind the recipient to a server-side state, unauthenticated users can force the site to send templa...