CVE-2026-105995

MediumCVSS 5.3/10Last modified Oct 13, 2026

Description

The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose other customers' personal information and booking cancellation tokens.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Unknown	Booking Package	< 1.7.30

References

https://wpscan.com/vulnerability/a778a758-4c44-45d6-bd34-9668bba2a95c/

Timeline

Published: Oct 10, 2026
Last modified: Oct 13, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1059964.8The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source of randomness, derivi CVE-2026-1059975.3The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recip CVE-2026-1059985.3The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscri CVE-2026-1059995.3The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in CVE-2026-10605.3The WP Adminify plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.7.7 via the /CVE-2026-106004.3Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to bound the time and resource consumptio CVE-2026-1060005.3The Booking Package WordPress plugin before 1.7.34 does not require payment to be completed before saving a booking on calendars configured CVE-2026-1060025.3The Court Reservation WordPress plugin before 1.12.4 does not perform any authorisation or nonce verification on one of its challenge-manag CVE-2026-1060035.3The Court Reservation WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce validation on one of its A CVE-2026-1060045.3The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated at CVE-2026-1060075.3The FraudLabs Pro SMS Verification WordPress plugin through 1.12.1 does not enforce its SMS-retry limit on the server side, allowing unauthe CVE-2026-1060085.3The FraudLabs Pro SMS Verification WordPress plugin from 1.11.2 to 1.12.1 does not perform authorisation or validity checks before marking a