CVE-2026-105996 Booking Package CVE debrief

Who should care

Defenders responsible for WordPress installations with the Booking Package plugin should assess exposure and prioritize upgrading to version 1.7.31 or later. This involves reviewing the current plugin version, verifying affected scope, and planning vendor-supported updates or mitigations through normal change control where exposure is confirmed. Defenders should also monitor for suspicious activity related to booking cancellations and PII disclosure, and

Why it matters

The Booking Package WordPress plugin vulnerability allows unauthenticated attackers to disclose personal data and cancel bookings, requiring defenders to verify and upgrade the plugin version.

• Unauthenticated attackers can disclose personal data of arbitrary bookings
• Unauthenticated attackers can cancel bookings where visitor cancellation is enabled
• Defenders need to verify the version of the Booking Package plugin and upgrade to version 1.7.31 or later
• Defenders should monitor for suspicious activity related to booking cancellations and PII disclosure

Technical summary

The Booking Package WordPress plugin before 1.7.31 generates booking cancellation tokens using a predictable source, allowing unauthenticated attackers to disclose personal data and cancel bookings. This vulnerability affects WordPress installations with the Booking Package plugin, requiring defenders to verify and upgrade the plugin version. The plugin's predictable token generation enables attackers to reconstruct arbitrary booking tokens, disclose personal data, and cancel bookings where visitor cancellation is enabled.

Defensive priority

Defenders should prioritize verifying the version of the Booking Package plugin and upgrading to version 1.7.31 or later to prevent unauthenticated booking PII disclosure and cancellation.

Recommended defensive actions

• Verify the version of the Booking Package plugin and upgrade to version 1.7.31 or later
• Review and update configurations to prevent unauthenticated access to booking data
• Monitor for suspicious activity related to booking cancellations and PII disclosure
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record and source item provide details on the vulnerability, but additional information from the vendor and other sources may be necessary to fully understand the impact and verify affected systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.