CVE-2026-105997: Booking Package < 1.7.33 - Unauthenticated Verification Email Sending to Arbitrary Recipient

Q: Who can exploit this issue?

Any unauthenticated user can trigger the affected plugin's booking verification-code email function. No account or prior booking state is required according to the available information.

Q: What is the practical impact?

An attacker can cause the site to send templated verification-code emails to arbitrary recipients. This can be abused to send unwanted email through the site and may create misleading verification messages for recipients.

Q: Which plugin versions are affected?

Booking Package versions before 1.7.33 are affected. Updating to version 1.7.33 or later addresses the described issue.

Published Oct 28, 2026

Updated

The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recipient to server-side state, allowing unauthenticated users to make the site send templated verification-code emails to arbitrary recipients.

Affected Software

1 affected component

WordPress Booking Package<1.7.33

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Booking Package WordPress plugin to a version that resolves this vulnerability.
Fixed in 1.7.33

Event History

Oct 28, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated user can trigger the affected plugin's booking verification-code email function. No account or prior booking state is required according to the available information.

What is the practical impact?

An attacker can cause the site to send templated verification-code emails to arbitrary recipients. This can be abused to send unwanted email through the site and may create misleading verification messages for recipients.

Which plugin versions are affected?

Booking Package versions before 1.7.33 are affected. Updating to version 1.7.33 or later addresses the described issue.

CVE-2026-105997: Booking Package < 1.7.33 - Unauthenticated Verification Email Sending to Arbitrary Recipient

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the practical impact?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the practical impact?

Which plugin versions are affected?