CVE-2026-105998 PUBLISHED

Booking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing Authorization

Assigner: WPScan
Reserved: 06.10.2026 Published: 21.10.2026 Updated: 21.10.2026

The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features.

Product Status

Vendor Unknown
Product Booking Package
Versions Default: unaffected
  • affected from 0 to 1.7.31 (excl.)

Credits

  • Md. Minaruzzaman Shovon finder
  • WPScan coordinator

References

Problem Types

  • CWE-862 Missing Authorization CWE