CVE-2026-105999 in Booking Package Plugin
Summary
by MITRE • 10/21/2026
The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administrator's notification email addresses.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified in the Booking Package WordPress plugin prior to version 1.7.31 represents a critical failure in access control mechanisms, specifically categorized under CWE-284 Improper Access Control. This flaw allows unauthenticated actors to interact with sensitive administrative endpoints without providing valid credentials or session tokens. The core technical issue lies in the server-side logic handling calendar-account configuration requests. Instead of verifying that the requesting user possesses the necessary privileges to view such data, the application processes these queries and returns detailed system configurations directly to any client making a request. This lack of authorization checks creates a direct path for information disclosure, bypassing standard WordPress security layers designed to restrict administrative functions to authenticated users with specific roles.
The operational impact of this vulnerability is significant due to the nature of the data exposed. The plugin discloses calendar-account configuration details which include administrator notification email addresses. While these emails may not contain passwords or cryptographic keys directly, they serve as valuable intelligence for attackers conducting reconnaissance and social engineering campaigns. Knowledge of administrative contact information allows threat actors to target specific individuals within an organization with high-precision phishing attacks. Furthermore, the exposure of internal system configurations can aid in mapping the attack surface of a WordPress installation, potentially revealing other misconfigurations or plugin versions that may be susceptible to additional exploits. This type of data leakage contributes to the broader risk profile by facilitating targeted attacks rather than broad-spectrum automated assaults.
From an offensive security perspective, this vulnerability aligns with techniques observed in the MITRE ATT&CK framework, particularly those related to Discovery and Collection. Attackers can leverage unauthenticated API endpoints or AJAX handlers to gather information about the target environment without triggering typical intrusion detection alerts associated with brute-force login attempts. The ability to retrieve administrative contact details via a simple HTTP request exemplifies how misconfigured web applications can be exploited for passive reconnaissance, reducing the effort required for subsequent stages of an attack chain such as credential stuffing or spear-phishing campaigns.
Mitigation strategies must prioritize immediate patching and access control hardening. Administrators running versions earlier than 1.7.31 should update to the latest stable release where this authorization logic has been corrected. In scenarios where updating is not immediately feasible, temporary mitigations include restricting access to WordPress admin-ajax.php or specific plugin endpoints via web application firewall rules that require valid authentication cookies for such requests. Additionally, implementing strict input validation and ensuring all administrative functions enforce role-based access control checks before processing sensitive data retrieval queries will prevent similar vulnerabilities in future updates. Regular security audits of custom plugins are essential to ensure compliance with secure coding standards and maintain the integrity of WordPress environments against unauthorized information disclosure.