CVE-2026-105998 — Booking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing Authorization

CVE-2026-105998

Booking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing Authorization PUBLISHED

Description (CNA)

The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features.

Affected (CNA)

Vendor / product	Versions
Unknown / Booking Package	affected 0 before 1.7.31

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/feb9d9bd-7192-4c75-9dc4-43d925518dc1/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.