CVE-2026-103423

CVE-2026-103423 · Booking Package <= 1.7.29 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'mode=sendBooking' with nonexistent 'timeKey' and 'public=0'

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.29 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve personally identifiable information for every booked customer stored in the booking_package_booked_customers table, including names, email addresses, phone numbers, physical addresses, and cancellation tokens. The nonce nominally protecting the endpoint is a public CSRF token emitted in the localized booking_package JavaScript object on any page rendering the [booking_package] shortcode or widget, making it trivially harvestable by unauthenticated visitors and providing no effective authentication barrier.

CVSS 7.5 · Élevée · EPSS 0,5%

Publication

2026-10-14T01:27:12.770Z

Mise à jour

2026-10-14T18:26:29.578Z

Vérifiez votre serveur →