CVE-2026-105992
CVE-2026-105992 · Ettrick Escape Room Booking < 1.3.1 - Unauthenticated Payment Confirmation Bypass
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not verify a booking's payment status against the payment provider before marking it paid and confirmed, allowing unauthenticated attackers to mark bookings as paid without paying.
CVSS 5.3 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
ettrick escape room booking
- Versions
- ≥ 0, < 1.3.1: Affected (semver)
Update to 1.3.1