Description
The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.29 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve personally identifiable information for every booked customer stored in the booking_package_booked_customers table, including names, email addresses, phone numbers, physical addresses, and cancellation tokens. The nonce nominally protecting the endpoint is a public CSRF token emitted in the localized booking_package JavaScript object on any page rendering the [booking_package] shortcode or widget, making it trivially harvestable by unauthenticated visitors and providing no effective authentication barrier.
Published: 2026-10-14
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Sensitive Data Exposure (PII disclosure)
Action: Immediate Patch
AI Analysis

Impact

The Booking Package plugin for WordPress fails to verify user authorization before executing the ‘sendBooking’ operation, allowing anyone to query a public endpoint and retrieve the full contents of the booking_package_booked_customers table, which contains names, email addresses, phone numbers, physical addresses, and cancellation tokens. This results in complete disclosure of personally identifiable information to unauthenticated attackers and is a classic authorization bypass (CWE‑862).

Affected Systems

The flaw affects the WordPress Booking Package plugin, version 1.7.29 and earlier, developed by masaakitanaka. All installations that enable the booking_package shortcode or widget are susceptible.

Risk and Exploitability

The CVSS score of 7.5 indicates high impact. The EPSS score of less than 1% indicates a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the presence of a public, harvestable CSRF token allows unauthenticated attackers to trivially send requests to the vulnerable endpoint from any exposed WordPress site, making exploitation feasible without additional privileges.

Generated by OpenCVE AI on October 16, 2026 at 01:49 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Booking Package plugin to version 1.8 or later to eliminate the unauthorized access to the 'sendBooking' endpoint.
  • If an immediate update is not possible, uninstall the plugin or disable the booking_package shortcode and widget to block the vulnerable functionality.
  • As a temporary workaround, restrict unauthenticated access to the plugin’s admin‑ajax.php endpoint or enforce role‑based restrictions to ensure only authenticated users can trigger the 'sendBooking' action.

Generated by OpenCVE AI on October 16, 2026 at 01:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 01:45:00 +0000

Type Values Removed Values Added
Description The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.29 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve personally identifiable information for every booked customer stored in the booking_package_booked_customers table, including names, email addresses, phone numbers, physical addresses, and cancellation tokens. The nonce nominally protecting the endpoint is a public CSRF token emitted in the localized booking_package JavaScript object on any page rendering the [booking_package] shortcode or widget, making it trivially harvestable by unauthenticated visitors and providing no effective authentication barrier.
Title Booking Package <= 1.7.29 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'mode=sendBooking' with nonexistent 'timeKey' and 'public=0'
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-10-14T18:26:29.578Z

Reserved: 2026-09-30T14:52:06.980Z

Link: CVE-2026-103423

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-14T02:16:54.710

Modified: 2026-10-14T19:17:06.730

Link: CVE-2026-103423

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T02:00:16Z

Weaknesses