Live › vulnerability › CVE-2026-105999
Go to dashboardThe Booking Package WordPress plugin before 1.7.31 returns calendar-account configuration without checking who is asking. An unauthenticated visitor can read those settings, including the site administrator's notification email addresses.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any WordPress site running the Booking Package plugin before with calendar accounts configured is exposed to unauthenticated reads of those settings. Sites that do not run the plugin, or run a fixed version, can skip it.
1.7.31No product ranges from the sources yet.
wp plugin get booking-package --field=version (the plugin slug is unknown from the sources; confirm it).1.7.31 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administrator's notification email addresses.
This page as .md · .json · in your agent: get_signal("CVE-2026-105999")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.