Live › vulnerability › CVE-2026-105996
Go to dashboardThe Booking Package WordPress plugin before 1.7.31 builds booking cancellation tokens from publicly visible values instead of a secure random source. An unauthenticated attacker can reconstruct a booking's token, read that booking's personal data, and cancel it where visitor cancellation is enabled.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Booking Package WordPress plugin older than 1.7.31 are exposed, since any visitor can guess a booking's cancellation token from public values. Sites where visitor cancellation is disabled still face disclosure of booking personal data. Sites not using this plugin can skip it.
No product ranges from the sources yet.
wp-content/plugins/1.7.31 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source of randomness, deriving them instead from values it exposes publicly, so an unauthenticated attacker can reconstruct an arbitrary booking's token, disclose that booking's personal data and, where visitor cancellation is enabled, cancel the booking.
This page as .md · .json · in your agent: get_signal("CVE-2026-105996")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.