CVE-2026-105992: Ettrick Booking Plugin Auth Bypass Flaw

CVE-2026-105992 Overview

CVE-2026-105992 affects the Ettrick Escape Room Booking WordPress plugin before version 1.3.1. The plugin does not verify a booking's payment status against the payment provider before marking it as paid and confirmed. Unauthenticated attackers can mark bookings as paid without actually completing payment. The flaw is categorized as a missing authorization issue [CWE-862] and stems from a business logic error in the payment confirmation workflow.

Critical Impact
Unauthenticated attackers can bypass the payment provider verification step to obtain confirmed escape room bookings without paying, resulting in revenue loss and inventory abuse for site operators.

Affected Products

Ettrick Escape Room Booking WordPress plugin versions prior to 1.3.1

Discovery Timeline

2026-10-21 - CVE-2026-105992 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-105992

Vulnerability Analysis

The Ettrick Escape Room Booking plugin processes bookings through a workflow that transitions reservations to a paid and confirmed state. The plugin trusts client-controlled input to update the booking state rather than performing a server-side verification call against the payment provider. An unauthenticated attacker can submit a crafted request to the booking confirmation endpoint and transition a pending booking to paid without any funds moving.

This is a business logic flaw rather than a memory corruption or injection issue. The impact is limited to booking integrity because no sensitive data is exposed and site availability is not affected. The vulnerability affects integrity only, which aligns with its scope limited to free, fraudulent reservations.

Root Cause

The root cause is missing authorization and missing server-to-server validation [CWE-862]. The plugin does not call back to the payment provider's API to confirm that a transaction completed successfully before updating the booking record. Any party that can reach the public confirmation endpoint can trigger the state transition.

Attack Vector

The attack vector is network-based and does not require authentication or user interaction. An attacker initiates a booking, intercepts or recreates the payment confirmation callback, and submits it directly to the plugin. The plugin accepts the input as proof of payment and marks the booking confirmed. The attack can be scripted against any WordPress site running an affected version of the plugin.

See the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-105992

Indicators of Compromise

Booking records marked paid with no matching transaction ID in the payment provider's dashboard.
Confirmed bookings whose creation and confirmation timestamps are seconds apart with no gateway redirect logs.
Repeated requests to the plugin's booking confirmation endpoint from a small set of source IPs.

Detection Strategies

Reconcile WordPress booking records against payment provider transaction exports on a daily cadence.
Review web server access logs for direct POST requests to the plugin's payment confirmation handler without a preceding gateway redirect.
Alert on bookings transitioning from pending to confirmed without an associated payment webhook signature.

Monitoring Recommendations

Enable verbose logging on the booking plugin and forward logs to a central SIEM for correlation.
Monitor WordPress plugin version inventory and flag any site still running Ettrick Escape Room Booking below 1.3.1.
Track unusual spikes in bookings outside normal business hours as an early signal of automated abuse.

How to Mitigate CVE-2026-105992

Immediate Actions Required

Update the Ettrick Escape Room Booking plugin to version 1.3.1 or later on every affected WordPress site.
Audit existing booking records against payment provider transaction logs and void any confirmed bookings that lack a matching transaction.
Rotate any payment provider API keys if logs suggest the confirmation endpoint was abused.

Patch Information

Upgrade to Ettrick Escape Room Booking version 1.3.1, which adds server-side verification of booking payment status against the payment provider before marking bookings paid. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Temporarily deactivate the plugin until the patched version can be installed.
Restrict access to the booking confirmation endpoint using a web application firewall rule that requires a valid gateway referrer or signed webhook header.
Manually review and confirm bookings against the payment provider dashboard until the patch is applied.

bash

# Example WP-CLI command to update the plugin to a fixed version
wp plugin update ettrick-escape-room-booking --version=1.3.1