CVE-2026-105995: Booking Package < 1.7.30 - Unauthenticated Booking Customer PII Disclosure
Published Oct 10, 2026
·Updated
The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose other customers' personal information and booking cancellation tokens.
Affected Software
1 affected component
wordpress/booking-package<1.7.30
Event History
Oct 10, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:16 AM
Description
Frequently Asked Questions
1
Who is exposed to this issue?
WordPress sites using the Booking Package plugin in versions earlier than 1.7.30 are affected. The exposed data includes stored reservation details, customers' personal information, and booking cancellation tokens.
2
What does an attacker need to exploit it?
An attacker does not need to authenticate. The issue results from missing authorization checks when reservation data is returned.
3
What should be done to remediate the issue?
Update the Booking Package plugin to version 1.7.30 or later. Versions before 1.7.30 are affected.