CVE-2026-105995 — Booking Package < 1.7.30 - Unauthenticated Booking Customer PII Disclosure

CVE-2026-105995

Booking Package < 1.7.30 - Unauthenticated Booking Customer PII Disclosure PUBLISHED

Description (CNA)

The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose other customers' personal information and booking cancellation tokens.

Affected (CNA)

Vendor / product	Versions
Unknown / Booking Package	affected 0 before 1.7.30

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/a778a758-4c44-45d6-bd34-9668bba2a95c/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.