CVE-2026-105997 Booking Package < 1.7.33 - Unauthenticated Verification Email Sending to Arbitrary Recipient

The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recipient to server-side state, allowing unauthenticated users to make the site send templated verification-code emails to arbitrary recipients...

EUVD-2026-111702

The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recipient to server-side state, allowing unauthenticated users to make the site send templated verification-code emails to arbitrary recipients...

CVE-2026-105997

The Booking Package WordPress plugin, in versions prior to 1.7.33 , is vulnerable to an issue where it fails to restrict who can trigger booking verification-code emails. Because the plugin does not bind the recipient to a server-side state, unauthenticated users can force the site to send templa...

PT-2026-127819

The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recipient to server-side state, allowing unauthenticated users to make the site send templated verification-code emails to arbitrary recipients...