CVE-2026-105997

The Booking Package WordPress plugin (versions prior to 1.7.33 ) is vulnerable to a flaw where it fails to restrict who can trigger booking verification-code emails. Because the plugin does not bind the recipient to a server-side state, unauthenticated users can force the website to send template...