CVE-2026-105995: medium-severity vulnerability in Booking Package
Booking Package < 1.7.30 - Unauthenticated Booking Customer PII Disclosure
Published
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 0.3%
exploitation probability
0.3%top 84% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose other customers' personal information and booking cancellation tokens.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Unknown · Booking Packagepublic PoCs found — 1
cve_referencewpscan.com/vulnerability/a778a758-4c44-45d6-bd34-9668bba2a95c/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Booking Package
In the same product, most dangerous first.
CVE-2026-105999MEDIUMBooking Package < 1.7.31 - Unauthenticated Calendar Account Information DisclosureEPSS 0.3%CVE-2026-16986MEDIUMBooking Package < 1.7.25 - Unauthenticated Price Manipulation via Service and Option Cost ParametersEPSS 0.3%CVE-2026-105998MEDIUMBooking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing AuthorizationEPSS 0.3%CVE-2026-105997MEDIUMBooking Package < 1.7.33 - Unauthenticated Verification Email Sending to Arbitrary RecipientEPSS 0.2%CVE-2026-105996MEDIUMBooking Package < 1.7.31 - Unauthenticated Booking PII Disclosure and Cancellation via Predictable TokenEPSS 0.2%