CVE-2026-103423: Booking Package <= 1.7.29 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'mode=sendBooking' with nonexistent 'timeKey' and 'public=0'
The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.29 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve personally identifiable information for every booked customer stored in the bookingpackagebookedcustomers table, including names, email addresses, phone numbers, physical addresses, and cancellation tokens. The nonce nominally protecting the endpoint is a public CSRF token emitted in the localized bookingpackage JavaScript object on any page rendering the [bookingpackage] shortcode or widget, making it trivially harvestable by unauthenticated visitors and providing no effective authentication barrier.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites running Booking Package version 1.7.29 or earlier are affected if they store booked-customer records in the plugin's booking_package_booked_customers table. Any unauthenticated remote visitor can potentially target the affected endpoint.
What does an attacker need to exploit it?
No account, privileges, or user interaction are required. The attacker can obtain the endpoint nonce from the localized booking_package JavaScript object on a page that renders the [booking_package] shortcode or widget, then use mode=sendBooking with a nonexistent timeKey and public=0.
What information could be disclosed?
An attacker may retrieve personally identifiable information for every booked customer stored by the plugin, including names, email addresses, phone numbers, physical addresses, and cancellation tokens.
Does the exposed nonce protect the endpoint from unauthenticated access?
No. The nonce is a public CSRF token available to unauthenticated visitors on pages rendering the plugin shortcode or widget, so it does not provide an effective authentication barrier.