CVE-2026-106000: Booking Package < 1.7.34 - Unauthenticated Payment Bypass
The Booking Package WordPress plugin before 1.7.34 does not require payment to be completed before saving a booking on calendars configured to require online payment, allowing unauthenticated users to create confirmed bookings without paying.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Booking Packageto a version that resolves this vulnerability.Fixed in 1.7.34
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Booking Package installations running a version earlier than 1.7.34 are affected when their calendars are configured to require online payment.
What does an attacker need to exploit it?
An attacker does not need authentication, user interaction, or payment completion. They can create confirmed bookings through the affected payment flow.
What is the practical impact of successful exploitation?
An attacker can place confirmed bookings on payment-required calendars without paying, potentially consuming available booking slots and bypassing the intended payment requirement.