CVE-2026-40774: WordPress Booking Package plugin <= 1.7.06 - Broken Access Control vulnerability

Q: Who can exploit this issue?

The vulnerability is unauthenticated, so an attacker does not need a WordPress account or prior access to the site. The CVSS vector indicates it can be exploited over the network with low attack complexity and no user interaction.

Q: What is the likely security impact?

The provided severity vector indicates an integrity impact only: I:H, with no stated confidentiality or availability impact. The description identifies the underlying issue as broken access control.

Q: Which installations are affected?

WordPress sites using the Booking Package plugin version 1.7.06 or earlier are identified as affected. The supplied data does not state whether any particular plugin configuration is required.

Published Jun 15, 2026

Updated

Unauthenticated Broken Access Control in Booking Package <= 1.7.06 versions.

Affected Software

1 affected component

WordPress Booking Package<=1.7.06

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Booking Package plugin to a version that resolves this vulnerability.
Fixed in 1.7.07

Event History

Jun 15, 2026

CVE Published

via MITRE·08:18 PM

Data Sourced

via MITRE·08:18 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·09:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The vulnerability is unauthenticated, so an attacker does not need a WordPress account or prior access to the site. The CVSS vector indicates it can be exploited over the network with low attack complexity and no user interaction.

What is the likely security impact?

The provided severity vector indicates an integrity impact only: I:H, with no stated confidentiality or availability impact. The description identifies the underlying issue as broken access control.

Which installations are affected?

WordPress sites using the Booking Package plugin version 1.7.06 or earlier are identified as affected. The supplied data does not state whether any particular plugin configuration is required.

CVE-2026-40774: WordPress Booking Package plugin <= 1.7.06 - Broken Access Control vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the likely security impact?

Which installations are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the likely security impact?

Which installations are affected?