CVE-2026-105998 in Booking Package Plugin
Summary
by MITRE • 10/22/2026
The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in the Booking Package WordPress plugin prior to version 1.7.31 represents a critical failure in access control mechanisms, specifically categorized under CWE-284 Improper Access Control and aligned with MITRE ATT&CK technique T1098 Account Manipulation or privilege escalation via administrative function abuse. This flaw stems from the absence of robust authorization checks when handling requests intended to reset or modify the plugin's premium subscription state. In a secure implementation, any operation that alters licensing status, feature availability, or payment validation must be strictly gated behind verified administrator credentials and potentially additional security tokens such as nonces. However, in this vulnerable version, the endpoint responsible for managing the subscription state accepts requests from unauthenticated sources without validating whether the requester possesses the necessary privileges to perform such actions.
The technical nature of this flaw allows an attacker who can reach the WordPress installation over HTTP or HTTPS to send a crafted request that triggers the reset logic within the plugin's codebase. Because there is no server-side verification of user roles, session validity, or cryptographic signatures associated with administrative tasks, the system blindly executes the command to disable premium features. This effectively downgrades the application from its licensed state to a free version without any legitimate payment or authorization process being completed. The vulnerability exploits the fundamental principle that sensitive configuration changes must require explicit authentication and authorization, which is entirely missing in this specific code path.
The operational impact of this vulnerability is significant for site administrators who rely on the premium features provided by the Booking Package plugin. By exploiting this flaw, an unauthenticated attacker can permanently or temporarily disable paid functionalities such as advanced booking management, custom field configurations, or priority support integrations that are part of the subscription package. This not only disrupts business operations but also undermines the integrity of the software licensing model. For organizations using this plugin for critical scheduling workflows, the sudden loss of premium capabilities could lead to data inconsistencies, lost appointments, and a degraded user experience for their customers who depend on these features.
Mitigation strategies must focus on immediate remediation through version updates and supplementary hardening measures. The primary solution is to upgrade the Booking Package WordPress plugin to version 1.7.31 or later, where the developers have presumably implemented proper authorization checks to ensure that only authenticated administrators with appropriate roles can modify subscription states. In addition to updating, site owners should enforce strict access controls on their wp-admin directory and critical PHP endpoints using web application firewalls to block unauthorized requests. It is also advisable to review server logs for any suspicious activity related to the plugin's API or AJAX handlers during the period of vulnerability exposure to assess if exploitation has occurred. Regular security audits and adherence to secure coding standards that mandate validation of user permissions before executing state-changing operations are essential preventive measures against such access control bypasses.