Live › vulnerability › CVE-2026-105992
Go to dashboardThe Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not check a booking's payment status with the payment provider before marking it paid and confirmed. An unauthenticated attacker can mark bookings as paid without paying.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Ettrick Escape Room Booking WordPress plugin before 1.3.1 that take payments for bookings through it. Sites without this plugin, or with it already at 1.3.1 or later, are not affected. The sources do not say whether a non-default setting is required.
No product ranges from the sources yet.
wp plugin get ettrick-escape-room-booking --field=version (slug unknown; confirm from the sources)1.3.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not verify a booking's payment status against the payment provider before marking it paid and confirmed, allowing unauthenticated attackers to mark bookings as paid without paying.
This page as .md · .json · in your agent: get_signal("CVE-2026-105992")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.