Live › vulnerability › CVE-2026-105997
Go to dashboardThe Booking Package WordPress plugin before 1.7.33 does not check who can request booking verification-code emails. An unauthenticated visitor can make the site send templated verification emails to any address they choose.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 06:31 UTC. All times on this page are UTC.
Sites running the Booking Package WordPress plugin before that use its booking verification-code emails are exposed. Sites without this plugin, or running or later, can skip it.
1.7.331.7.33No product ranges from the sources yet.
wp-content/plugins/ for the plugin's main file header.1.7.33 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recipient to server-side state, allowing unauthenticated users to make the site send templated verification-code emails to arbitrary recipients.
This page as .md · .json · in your agent: get_signal("CVE-2026-105997")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.