CVE-2026-105995: Booking Package Information Disclosure Flaw

CVE-2026-105995 Overview

CVE-2026-105995 is an information disclosure vulnerability in the Booking Package WordPress plugin before version 1.7.30. The plugin fails to perform authorization checks before returning stored reservation data. Unauthenticated attackers can retrieve other customers' personal information and booking cancellation tokens by querying affected endpoints over the network. The flaw is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated remote attackers can harvest personally identifiable information (PII) and booking cancellation tokens belonging to other customers, enabling identity misuse and unauthorized cancellation of reservations.

Affected Products

Booking Package WordPress plugin versions prior to 1.7.30
WordPress sites running the plugin with public-facing booking workflows
Any site exposing the plugin's reservation data endpoints to unauthenticated requests

Discovery Timeline

2026-10-10 - CVE-2026-105995 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-105995

Vulnerability Analysis

The Booking Package plugin exposes server-side functionality that returns stored reservation records to clients. The vulnerable code path serves reservation data without verifying the caller's identity or ownership of the record. An attacker can submit crafted requests to the plugin's endpoints and receive customer details intended only for the booking owner or site administrators.

Returned fields include customer personal information collected during the booking process and the cancellation token associated with each reservation. Possession of a cancellation token lets an attacker cancel reservations without authentication, disrupting business operations and inconveniencing legitimate customers. The disclosure also exposes data subject to privacy regulations such as GDPR and CCPA.

Root Cause

The root cause is a missing authorization check [CWE-200, related to CWE-862] in the handler responsible for returning reservation data. The code trusts request parameters identifying the reservation and returns the stored record without validating that the caller owns the booking or holds a privileged role. No session, nonce, or capability check gates access to the response.

Attack Vector

Exploitation requires only network access to the WordPress site. No authentication, user interaction, or elevated privileges are needed. An attacker enumerates reservation identifiers through the plugin's exposed endpoint and parses responses to collect PII and cancellation tokens. Refer to the WPScan Vulnerability Report for technical specifics of the vulnerable request flow.

Detection Methods for CVE-2026-105995

Indicators of Compromise

Repeated unauthenticated requests to Booking Package plugin AJAX or REST endpoints from a single source IP
Sequential or enumerated reservation identifier values appearing in web server access logs
Spikes in outbound response sizes from plugin endpoints that normally return minimal data
Unexpected booking cancellations correlated with prior anonymous read requests

Detection Strategies

Review WordPress and web server logs for unauthenticated admin-ajax.php or REST API calls targeting Booking Package actions
Alert on high-volume requests from a single client to plugin endpoints returning reservation data
Correlate access-log patterns with subsequent cancellation events to identify token abuse

Monitoring Recommendations

Enable verbose request logging for the Booking Package plugin and forward logs to a centralized analytics platform
Monitor response payload sizes and status codes for the plugin's data endpoints to flag anomalous bulk retrieval
Track reservation cancellation activity by source IP, user agent, and time window to surface automated abuse

How to Mitigate CVE-2026-105995

Immediate Actions Required

Upgrade the Booking Package plugin to version 1.7.30 or later on all affected WordPress sites
Audit recent web server and plugin logs for unauthenticated access to reservation endpoints prior to patching
Notify affected customers if log review indicates their reservation data was disclosed, in line with applicable privacy regulations
Rotate or invalidate existing booking cancellation tokens where supported by the updated plugin

Patch Information

The vendor addressed the issue in Booking Package version 1.7.30 by adding authorization checks to the vulnerable data-return path. Update the plugin through the WordPress admin dashboard or by replacing the plugin files with the fixed release. See the WPScan Vulnerability Report for the full advisory.

Workarounds

Deactivate the Booking Package plugin until the site can be updated to version 1.7.30 or later
Restrict access to the plugin's AJAX and REST endpoints at the web application firewall (WAF) by blocking unauthenticated callers
Apply rate limiting to the plugin's reservation endpoints to slow enumeration attempts

bash

# Example WAF rule concept to block unauthenticated access to the vulnerable action
# Replace <action_name> with the specific plugin action identified in logs
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1050995,msg:'Block unauthenticated Booking Package reservation reads'"
SecRule ARGS:action "@streq <action_name>" \
  "chain"
SecRule &REQUEST_COOKIES:wordpress_logged_in "@eq 0"