CVE-2026-103423: WordPress Booking Package Auth Bypass Flaw

CVE-2026-103423 Overview

CVE-2026-103423 is an authorization bypass vulnerability in the Booking Package plugin for WordPress affecting all versions through 1.7.29. The plugin fails to verify that a caller is authorized to retrieve stored booking data. Unauthenticated attackers can enumerate the booking_package_booked_customers table and extract personally identifiable information (PII) for every booked customer, including names, email addresses, phone numbers, physical addresses, and cancellation tokens. The nonce intended to protect the endpoint is a public cross-site request forgery (CSRF) token emitted in the localized booking_package JavaScript object on any page rendering the [booking_package] shortcode or widget. The weakness is tracked under CWE-862: Missing Authorization.

Critical Impact
Unauthenticated remote attackers can exfiltrate the entire customer PII dataset from affected WordPress sites, enabling downstream phishing, fraud, and booking cancellation abuse via leaked cancellation tokens.

Affected Products

WordPress Booking Package plugin versions <= 1.7.29
Any WordPress site publicly rendering the [booking_package] shortcode or widget
Deployments relying on the plugin's booking workflow to store customer PII

Discovery Timeline

2026-10-14 - CVE-2026-103423 published to the National Vulnerability Database (NVD)
2026-10-14 - Last updated in the NVD database

Technical Details for CVE-2026-103423

Vulnerability Analysis

The Booking Package plugin exposes an AJAX endpoint that returns booked-customer records without validating the caller's role, capability, or identity. The handler relies solely on a WordPress nonce as its gatekeeper. Because the nonce is embedded in a client-side JavaScript object on any public page that renders the booking shortcode or widget, any unauthenticated visitor can harvest it and replay it against the endpoint.

Once the attacker holds a valid nonce, the vulnerable code path returns the contents of the booking_package_booked_customers table. The response set includes names, email addresses, phone numbers, physical addresses, and cancellation tokens. Cancellation tokens are particularly impactful because they permit a remote actor to cancel legitimate bookings without authentication, enabling business disruption in addition to PII loss.

Root Cause

The root cause is missing authorization [CWE-862]. The plugin conflates CSRF protection with access control. Nonces in WordPress are designed to prevent cross-site request forgery, not to authenticate users. Because the plugin omits a current_user_can() or equivalent capability check before returning sensitive data, any requester presenting the public nonce receives the full record set. Relevant handlers are referenced in index.php and lib/Schedule.php of the 1.7.29 source tree.

Attack Vector

An unauthenticated attacker loads any public page containing the [booking_package] shortcode or widget and extracts the nonce from the localized booking_package JavaScript object in the HTML response. The attacker then issues an HTTP POST request to the plugin's AJAX endpoint on admin-ajax.php with the harvested nonce and the parameters that trigger the customer-list action. The server responds with the full PII dataset in a single network-reachable request requiring no privileges and no user interaction.

See the Wordfence Vulnerability Report and the WordPress Booking Package Changeset for the specific code paths and the applied fix.

Detection Methods for CVE-2026-103423

Indicators of Compromise

Unauthenticated POST requests to /wp-admin/admin-ajax.php referencing Booking Package actions with abnormally large response bodies.
Repeated requests from a single IP that first GET a page containing the [booking_package] shortcode and then immediately POST to admin-ajax.php.
Responses containing JSON arrays with keys matching customer PII fields (name, email, phone, address, cancellation_token).
Spikes in outbound booking-cancellation events tied to valid cancellation tokens but originating from unusual IPs or user agents.

Detection Strategies

Deploy web application firewall (WAF) rules that correlate harvesting of the booking page HTML with subsequent AJAX calls from the same source.
Alert on unauthenticated AJAX responses from the Booking Package endpoint whose payload exceeds a size threshold indicating bulk extraction.
Review web server access logs for high-volume admin-ajax.php requests referencing booking package actions outside normal business patterns.

Monitoring Recommendations

Enable verbose logging on the plugin's AJAX handler and forward logs to a centralized SIEM for retention and search.
Baseline the normal volume of booking lookups per source IP and alert on statistical outliers.
Monitor the booking_package_booked_customers table for read patterns consistent with full-table enumeration.

How to Mitigate CVE-2026-103423

Immediate Actions Required

Update the Booking Package plugin to a version later than 1.7.29 as soon as the vendor publishes a fixed release.
If no patched release is yet available, deactivate the Booking Package plugin on production sites that expose the shortcode or widget publicly.
Rotate all existing cancellation tokens and notify affected customers if evidence of enumeration is found in logs.
Treat the booking_package_booked_customers dataset as potentially exposed and apply any applicable breach-notification obligations.

Patch Information

The vendor committed a code change tracked in the WordPress Booking Package Changeset 3728015. Administrators should install the first plugin release that incorporates this changeset and verify the installed version in the WordPress plugin dashboard. Review the vulnerable handlers in the 1.7.29 Schedule.php source to confirm the fix is present in the deployed build.

Workarounds

Remove the [booking_package] shortcode and widget from all publicly reachable pages to prevent nonce harvesting until the patch is applied.
Place the booking functionality behind authentication, restricting access to logged-in users via a membership or access-control plugin.
Add WAF rules blocking unauthenticated POST requests to the Booking Package AJAX actions responsible for returning customer records.
Restrict access to admin-ajax.php by source IP where feasible, limiting exposure to known administrative networks.

bash

# Configuration example: WordPress CLI update and verification
wp plugin update booking-package
wp plugin get booking-package --field=version

# Temporary deactivation if a patched release is not yet available
wp plugin deactivate booking-package