{"schemaVersion":3,"id":"CVE-2026-105998","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features.","dates":{"published":"2026-10-21T06:00:18.969Z","modified":"2026-10-21T10:35:07.028Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.3,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00153,"percentile":0.04101,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-10-21T00:00:00.000Z","score":0.00153,"percentile":0.04101}],"last30":[{"date":"2026-10-21T00:00:00.000Z","score":0.00153,"percentile":0.04101}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_967F20AEC8CBF739","name":"Exploit Reference (wpscan.com)","source":"reference","url":"https://wpscan.com/vulnerability/feb9d9bd-7192-4c75-9dc4-43d925518dc1/","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action.","type":"weakness","status":"Incomplete","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/862.html"}],"affected":[{"vendor":"unknown","product":"booking package","name":"Booking Package","label":"booking package","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 1.7.31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.7.31","eol":null,"hubHref":"/vendor/unknown/booking_package"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://wpscan.com/vulnerability/feb9d9bd-7192-4c75-9dc4-43d925518dc1/","label":"wpscan.com/vulnerability/feb9d9bd-7192-4c75-9dc4-43d925518dc1/","hostname":"wpscan.com","tags":["Exploit","VDB Entry","Technical Description"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-21T06:00:18.969Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-21T10:35:07.028Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":31,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T07:19:38.077Z","stale":false,"partial":false}}