← CVE Intelligence

CVE-2026-105992

Ettrick Escape Room Booking < 1.3.1 - Unauthenticated Payment Confirmation Bypass PUBLISHED

Description (CNA)

The Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not verify a booking's payment status against the payment provider before marking it paid and confirmed, allowing unauthenticated attackers to mark bookings as paid without paying.

Affected (CNA)

Vendor / productVersions
Unknown / Ettrick Escape Room Bookingaffected 0 before 1.3.1

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.