CVE-2026-105998 Booking Package CVE debrief

Who should care

Defenders responsible for WordPress installations with the Booking Package plugin should assess exposure and prioritize updating to version 1.7.31 or later to prevent unauthorized subscription deactivation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify the plugin version and review access controls for the plugin.

Why it matters

The CVE-2026-105998 vulnerability in the Booking Package WordPress plugin allows unauthenticated attackers to deactivate paid features. Defenders should prioritize verifying the plugin version and updating to 1.7.31 or later to prevent unauthorized subscription deactivation.

• Potential unauthorized deactivation of paid features
• Required verification of plugin version and update to 1.7.31 or later
• Monitoring for potential unauthorized subscription deactivation attempts

Technical summary

The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the paid features of the plugin. This vulnerability affects WordPress installations with the Booking Package plugin, potentially allowing attackers to deactivate paid features without authorization. The plugin's lack of authorization and validity checks enables unauthenticated attackers to reset the premium subscription state.

Defensive priority

Defenders should prioritize verifying the version of the Booking Package plugin and ensuring it is updated to 1.7.31 or later to prevent unauthorized subscription deactivation.

Recommended defensive actions

• Verify the version of the Booking Package plugin and update to 1.7.31 or later
• Monitor for potential unauthorized subscription deactivation attempts
• Review and adjust access controls for the plugin
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, but there is limited information on potential exploitation or affected systems. Defenders should verify the plugin version and review access controls for the plugin. The CVE Program record and NIST NVD detail page offer additional information on the vulnerability. Supplemental sources may provide further context on affected systems and potential exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.