CVE-2026-105998: Booking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing Authorization

Q: Who can exploit this issue?

Any unauthenticated attacker can exploit it; no login or authorization is required.

Q: What is the practical impact of exploitation?

An attacker can reset the plugin's premium subscription state and disable its paid features. The provided information does not indicate that the issue exposes WordPress accounts or data.

Q: Which installations are affected?

WordPress sites using Booking Package versions earlier than 1.7.31 are affected. Version 1.7.31 is identified as the version where the missing authorization and validity checks are addressed.

Published Oct 21, 2026

Updated

The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features.

Affected Software

1 affected component

WordPress Booking Package<1.7.31

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Booking Package WordPress plugin to a version that resolves this vulnerability.
Fixed in 1.7.31

Event History

Oct 21, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated attacker can exploit it; no login or authorization is required.

What is the practical impact of exploitation?

An attacker can reset the plugin's premium subscription state and disable its paid features. The provided information does not indicate that the issue exposes WordPress accounts or data.

Which installations are affected?

WordPress sites using Booking Package versions earlier than 1.7.31 are affected. Version 1.7.31 is identified as the version where the missing authorization and validity checks are addressed.

CVE-2026-105998: Booking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing Authorization

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the practical impact of exploitation?

Which installations are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the practical impact of exploitation?

Which installations are affected?