The Booking Package WordPress plugin versions earlier than 1.7.30 lacks proper authorization checks when returning reservation data. Because of this oversight, anyone who can send unauthenticated requests to the plugin's endpoints can read other customers’ personal information and booking cancellation tokens. This disclosure exposes sensitive PII and could enable phishing, identity theft, or fraudulent booking cancellations.

WordPress installations that use the Booking Package plugin with a version older than 1.7.30. The vulnerability is specific to the plugin’s reservation data endpoints and does not require any user credentials to exploit.

The vulnerability can be exploited without authentication by crafting a request to the affected plugin’s reservation endpoint. The CVSS score of 5.3 indicates moderate risk, but the privacy impact is significant. Because the EPSS score is unknown and the CVE is not in the CISA KEV catalog, the likelihood of widespread exploitation cannot be precisely quantified; however, attackers can readily discover the flaw via standard scanning techniques. The attack surface is public, making it a moderate to high risk for sites that expose booking data.