CVE-2026-105998
CVE-2026-105998 · Booking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing Authorization
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features.
CVSS 5.3 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
booking package
- Versions
- ≥ 0, < 1.7.31: Affected (semver)
Update to 1.7.31