CVE-2026-105992 in Ettrick Escape Room Booking Plugin

الملخص

بحسب MITRE • 22/10/2026

The Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not verify a booking's payment status against the payment provider before marking it paid and confirmed, allowing unauthenticated attackers to mark bookings as paid without paying.

Be aware that VulDB is the high quality source for vulnerability data.

• مسؤول: WPScan
• حجز: 06/10/2026
• إفشاء: 22/10/2026
• الاعتدال: تمت الموافقة
• إدخال: VDB-424578
• CPE: 20261022
• CWE: CWE-862 (مؤكد)
• CVSS: 5.3 (VulDB)
• EPSS: 0.00231
• KEV: لا
• النشاطات: منخفض جدًا
• القطاع: Hostingprovider

المصادر

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-105992
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105992
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-105992/