CVE-2026-105999: Booking Package < 1.7.31 - Unauthenticated Calendar Account Information Disclosure
The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administrator's notification email addresses.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Booking Package WordPress pluginto a version that resolves this vulnerability.Fixed in 1.7.31
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated user can exploit it because the affected plugin returns calendar-account configuration without authorization checks. No WordPress account or administrative access is required.
What information may be exposed?
The exposed calendar-account configuration can include sensitive settings, including administrator notification email addresses.
Which installations are affected?
WordPress sites using Booking Package versions earlier than 1.7.31 are affected. The issue is not described as requiring a non-default configuration.