The Booking Package WordPress plugin before version 1.7.33 lacks restrictions on who can trigger booking verification-code emails and does not bind the email recipient to server‑side state. As a result, any unauthenticated visitor can cause the site to send templated verification-code emails to arbitrary recipients, creating a channel for mass spam or phishing attempts and potentially eroding trust in the domain used for the emails.

WordPress installations that have the Booking Package plugin installed with a version older than 1.7.33. The affected vendor is listed as Unknown:Booking Package. No other vendors or products are explicitly mentioned.

The vulnerability does not require authentication, so the barrier to exploitation is low. Because no exploit was reported or listed in CISA’s KEV catalog and the EPSS metric is unavailable, the likelihood of widespread exploitation is uncertain, yet the low effort to trigger unwanted emails makes this a non‑negligible risk for sites that receive a high volume of traffic or use the plugin extensively.