{"id":"CVE-2026-105992","kind":"vulnerability","aliases":["CVE-2026-105992"],"related":[],"title":"Ettrick Escape Room Booking WordPress plugin: unpaid bookings can be marked paid","description":"The Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not verify a booking's payment status against the payment provider before marking it paid and confirmed, allowing unauthenticated attackers to mark bookings as paid without paying.","summary":"The Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not check a booking's payment status with the payment provider before marking it paid and confirmed. An unauthenticated attacker can mark bookings as paid without paying.","severity":"medium","cvss":5.3,"epss":0.00231,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["escape-room-booking","package","payments","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed","version-1.3.1-or-later"],"how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen, or with `wp plugin get ettrick-escape-room-booking --field=version` (slug unknown; confirm from the sources)\n- Review recent bookings for entries marked paid with no matching payment record at the provider","fix":"- Update the Ettrick Escape Room Booking plugin to `1.3.1` or later\n- Reconcile bookings marked paid since the plugin was installed against the payment provider's records","status":"open","published_at":"2026-10-21T06:16:46+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T04:22:21+00:00","updated_at":"2026-10-25T04:22:21+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:22:21Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Ettrick Escape Room Booking plugin to `1.3.1` or later\n- Reconcile bookings marked paid since the plugin was installed against the payment provider's records","reach":"internet","title":"Ettrick Escape Room Booking WordPress plugin: unpaid bookings can be marked paid","impact":"medium","summary":"The Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not check a booking's payment status with the payment provider before marking it paid and confirmed. An unauthenticated attacker can mark bookings as paid without paying.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","escape-room-booking","payments"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker gets confirmed bookings without paying","analyst_note":"Check the NVD entry and the plugin's changelog for the exact affected endpoint and whether any setting is needed to trigger the flaw.","how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen, or with `wp plugin get ettrick-escape-room-booking --field=version` (slug unknown; confirm from the sources)\n- Review recent bookings for entries marked paid with no matching payment record at the provider","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-1.3.1-or-later"],"who_is_affected":"Sites running the Ettrick Escape Room Booking WordPress plugin before 1.3.1 that take payments for bookings through it. Sites without this plugin, or with it already at 1.3.1 or later, are not affected. The sources do not say whether a non-default setting is required.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000647,"input_tokens":3346,"output_tokens":624,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-105992':15A,18A '-2026':14A,17A '1.3.1':37B,74C 'allow':93C 'attack':58B,95C 'book':4A,8A,22B,33B,42B,61B,70C,79C,98C 'check':40B 'confirm':55B,92C 'cve':13A,16A 'escap':2A,20B,31B,68C 'escape-room-book':19B 'ettrick':1A,30B,67C 'mark':11A,51B,60B,88C,97C 'packag':23B 'paid':12A,53B,63B,90C,100C 'pay':65B,102C 'payment':24B,44B,48B,81C,85C 'plugin':6A,28B,35B,72C 'provid':49B,86C 'room':3A,21B,32B,69C 'status':45B,82C 'unauthent':57B,94C 'unpaid':7A 'verifi':77C 'without':64B,101C 'wordpress':5A,25B,27B,34B,71C 'wordpress-plugin':26B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Ettrick Escape Room Booking WordPress plugin before 1.3.1 that take payments for bookings through it. Sites without this plugin, or with it already at 1.3.1 or later, are not affected. The sources do not say whether a non-default setting is required.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T06:16:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105992","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105992","severity":null,"published_at":"2026-10-21T06:16:46+00:00","modified_at":"2026-10-21T18:37:38+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-105992","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105992","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}