Unknown Booking Package vulnerabilities

2 vulnerabilities

Known vulnerabilities in Unknown Booking Package, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

5.3CVE-2026-105999unknownbooking packageThe Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administrator's notification email addresses.5.3CVE-2026-105998unknownbooking packageThe Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features.4.8CVE-2026-105996unknownbooking packageThe Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source of randomness, deriving them instead from values it exposes publicly, so an unauthenticated attacker can reconstruct an arbitrary booking's token, disclose that booking's personal data and, where visitor cancellation is enabled, cancel the booking.5.3CVE-2026-105995unknownbooking package+1
EPSS score
0.25%
The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose other customers' personal information and booking cancellation tokens.5.3CVE-2026-16986unknownbooking package+1
EPSS score
0.22%
The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected charge from attacker-supplied request values instead, so an unauthenticated attacker can pay an arbitrary fraction of a service's real price.