CVE-2026-105998: Booking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing Authorization
The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Booking Package WordPress pluginto a version that resolves this vulnerability.Fixed in 1.7.31
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated attacker can exploit it; no login or authorization is required.
What is the practical impact of exploitation?
An attacker can reset the plugin's premium subscription state and disable its paid features. The provided information does not indicate that the issue exposes WordPress accounts or data.
Which installations are affected?
WordPress sites using Booking Package versions earlier than 1.7.31 are affected. Version 1.7.31 is identified as the version where the missing authorization and validity checks are addressed.