The Booking Package WordPress plugin before version 1.7.31 derives booking cancellation tokens from publicly exposed data instead of a secure random source. An unauthenticated attacker can reconstruct a booking’s token, access personal information associated with that booking, and, if service cancellation is enabled, cancel the booking. This flaw allows disclosure of personal data and unauthorized alteration of bookings.

The vulnerability affects all installations of the Booking Package plugin for WordPress running a version older than 1.7.31. No specific vendor name is provided beyond the plugin identifier; any site using this plugin in that version range is impacted.

The description suggests that an unauthenticated web request could trigger the flaw, but this inference is not explicitly stated in the official description. Once the target URL is known, the token can be derived from public data, making exploitation straightforward. The CVSS score of 4.8 indicates a moderate overall risk. The EPSS score of less than 1% suggests that it has not yet been widely exploited, and it is not listed in the CISA KEV catalog. However, the weaknesses it exploits—improper access control, weak randomness, and lack of cryptographic protection—create a tangible risk for data exposure and unauthorized cancellations.