Live › vulnerability › CVE-2026-105998
Go to dashboardThe Booking Package WordPress plugin before 1.7.31 resets its premium subscription state without any authorization or validity check. An unauthenticated attacker can use this to turn off the plugin's paid features.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Booking Package WordPress plugin before 1.7.31 that use its premium features. The flaw is reachable without logging in, so any internet-facing site with the plugin installed is exposed. Sites without the plugin, or already on or later, can skip it.
1.7.31No product ranges from the sources yet.
wp plugin get <plugin-slug> --field=version1.7.31; anything lower is affected1.7.31 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features.
This page as .md · .json · in your agent: get_signal("CVE-2026-105998")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.