CVE-2026-106000 · Package
NO FIX YET · SEE WHAT TO DO
The Booking Package WordPress plugin before 1.7.34 saves a booking on calendars that require online payment without checking that payment was completed. An unauthenticated visitor can get a confirmed booking without paying.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Sites running the Booking Package WordPress plugin before 1.7.34 with calendars set to require online payment. Sites without those payment-required calendars, or running a fixed version, are not affected by this description.
Not affected if fixed-version, no-online-payment-calendars
Who cares booking-package, self-hosted, wordpress
1.7.34 are in scope.1.7.34 or later.The Booking Package WordPress plugin before 1.7.34 does not require payment to be completed before saving a booking on calendars configured to require online payment, allowing unauthenticated users to create confirmed bookings without paying.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.