CVE-2026-105996: Booking Package < 1.7.31 - Unauthenticated Booking PII Disclosure and Cancellation via Predictable Token
The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source of randomness, deriving them instead from values it exposes publicly, so an unauthenticated attacker can reconstruct an arbitrary booking's token, disclose that booking's personal data and, where visitor cancellation is enabled, cancel the booking.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Booking Package WordPress pluginto a version that resolves this vulnerability.Fixed in 1.7.31
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker can exploit it because the booking cancellation token can be reconstructed from publicly exposed values. No authenticated WordPress account is required.
What information can an attacker access or change?
An attacker who reconstructs a booking's token can disclose that booking's personal data. If visitor cancellation is enabled, the attacker can also cancel the booking.
Are all affected installations exposed to booking cancellation?
Personal-data disclosure is described for affected versions before 1.7.31. Booking cancellation additionally depends on whether visitor cancellation is enabled.
What version fixes the issue?
Update the Booking Package plugin to version 1.7.31 or later.