{"id":"CVE-2026-105998","kind":"vulnerability","aliases":["CVE-2026-105998"],"related":[],"title":"Booking Package WordPress plugin: unauthenticated reset disables paid features","description":"The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features.","summary":"The Booking Package WordPress plugin before 1.7.31 resets its premium subscription state without any authorization or validity check. An unauthenticated attacker can use this to turn off the plugin's paid features.","severity":"medium","cvss":5.3,"epss":0.00231,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["booking-package","package","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed","plugin-version-1.7.31-or-later"],"how_to_check":"- Check the installed version of the Booking Package plugin in the WordPress admin under Plugins, or with `wp plugin get <plugin-slug> --field=version`\n- Compare the result against `1.7.31`; anything lower is affected","fix":"- Update the Booking Package WordPress plugin to `1.7.31` or later","status":"open","published_at":"2026-10-21T06:16:46+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T04:21:13+00:00","updated_at":"2026-10-25T04:21:13+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:21:13Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Booking Package WordPress plugin to `1.7.31` or later","reach":"internet","title":"Booking Package WordPress plugin: unauthenticated reset disables paid features","impact":"low","summary":"The Booking Package WordPress plugin before 1.7.31 resets its premium subscription state without any authorization or validity check. An unauthenticated attacker can use this to turn off the plugin's paid features.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","booking-package"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker disables the plugin's paid features without logging in","analyst_note":"","how_to_check":"- Check the installed version of the Booking Package plugin in the WordPress admin under Plugins, or with `wp plugin get <plugin-slug> --field=version`\n- Compare the result against `1.7.31`; anything lower is affected","needs_analyst":false,"not_affected_if":["plugin-version-1.7.31-or-later","plugin-not-installed"],"who_is_affected":"Sites running the Booking Package WordPress plugin before `1.7.31` that use its premium features. The flaw is reachable without logging in, so any internet-facing site with the plugin installed is exposed. Sites without the plugin, or already on `1.7.31` or later, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000587,"input_tokens":3340,"output_tokens":506,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-105998':12A,15A '-2026':11A,14A '1.7.31':30B,62C,88C 'allow':77C 'attack':44B,79C 'author':38B,67C 'book':1A,17B,25B,57C,83C 'booking-packag':16B 'check':41B,70C 'cve':10A,13A 'disabl':7A,81C 'featur':9A,55B,91C 'packag':2A,18B,19B,26B,58C,84C 'paid':8A,54B,90C 'perform':65C 'plugin':4A,23B,28B,52B,60C,86C 'premium':33B,74C 'reset':6A,31B,72C 'state':35B,76C 'subscript':34B,75C 'turn':49B 'unauthent':5A,43B,78C 'use':46B 'valid':40B,69C 'without':36B 'wordpress':3A,20B,22B,27B,59C,85C 'wordpress-plugin':21B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Booking Package WordPress plugin before `1.7.31` that use its premium features. The flaw is reachable without logging in, so any internet-facing site with the plugin installed is exposed. Sites without the plugin, or already on `1.7.31` or later, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T06:16:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105998","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105998","severity":null,"published_at":"2026-10-21T06:16:46+00:00","modified_at":"2026-10-21T18:37:38+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-105998","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105998","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}