CVE-2026-105995 in Booking Package Plugin
Summary
by MITRE • 10/10/2026
The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose other customers' personal information and booking cancellation tokens.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/10/2026
The vulnerability identified in the Booking Package WordPress plugin prior to version 1.7.30 represents a critical failure in access control mechanisms, specifically categorized under CWE-284 Improper Access Control. This flaw stems from the application's inability to verify whether the requesting user has legitimate authorization to view specific reservation data before processing and returning that information. In secure software architecture, any endpoint or function that retrieves sensitive stored records must strictly validate the identity and permissions of the caller against the resource being accessed. The absence of these checks creates a direct path for unauthenticated actors to interact with internal application logic as if they were authorized users, bypassing standard authentication gates entirely.
From an operational perspective, this lack of authorization enforcement allows remote attackers to exploit the vulnerability through simple HTTP requests without needing valid credentials or session tokens. By manipulating parameters associated with reservation identifiers, an attacker can query the database for details belonging to other customers. The disclosed information typically includes personally identifiable information such as names, contact details, and potentially payment information depending on how the plugin stores data. Furthermore, the exposure of booking cancellation tokens is particularly severe because these tokens often serve as single-use or time-sensitive keys that allow third parties to modify or cancel reservations without owner consent. This transforms a simple data leak into a potential service disruption vector where malicious actors can interfere with legitimate business operations by cancelling bookings made by other users.
The impact extends beyond immediate privacy violations, affecting the integrity and availability of services provided through the WordPress site. For businesses relying on this plugin for appointments or reservations, such vulnerabilities erode customer trust and expose them to regulatory penalties under data protection laws like GDPR or CCPA due to the unauthorized disclosure of personal data. Additionally, the ability to cancel bookings can lead to direct financial losses and operational chaos, particularly in industries where reservation slots are limited and time-sensitive. The vulnerability aligns with ATT&CK technique T1078 Valid Accounts if combined with credential theft, but more accurately reflects T1539 Steal Web Session Cookie or general data exfiltration patterns where unauthenticated access is leveraged to harvest sensitive information from the backend systems.
Mitigation strategies must prioritize immediate patching and robust input validation practices. The primary remediation step is upgrading the Booking Package plugin to version 1.7.30 or later, which addresses these authorization checks by implementing proper server-side verification of user permissions before any data retrieval occurs. Developers should ensure that all API endpoints and database queries enforce strict ownership verification, confirming that the current session's identity matches the owner of the requested resource. Furthermore, implementing rate limiting on reservation-related endpoints can help mitigate automated exploitation attempts while patches are being deployed. Security monitoring tools should be configured to detect unusual patterns of data access from unauthenticated sources, providing an additional layer of defense against potential abuse of this vulnerability until all instances are updated.