---
id: "CVE-2026-105998"
kind: "vulnerability"
aliases: ["CVE-2026-105998"]
title: "Booking Package WordPress plugin: unauthenticated reset disables paid features"
severity: "medium"
cvss: 5.3
epss: 0.00231
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["booking-package", "package", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-not-installed", "plugin-version-1.7.31-or-later"]
published_at: "2026-10-21T06:16:46+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T04:21:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105998", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-105998", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Booking Package WordPress plugin: unauthenticated reset disables paid features

The Booking Package WordPress plugin before 1.7.31 resets its premium subscription state without any authorization or validity check. An unauthenticated attacker can use this to turn off the plugin's paid features.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Booking Package plugin in the WordPress admin under Plugins, or with `wp plugin get <plugin-slug> --field=version`
- Compare the result against `1.7.31`; anything lower is affected

## Fix

- Update the Booking Package WordPress plugin to `1.7.31` or later

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105998
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-105998

## From the sources

The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_