CVE-2026-105996: Booking Package Plugin Info Disclosure

CVE-2026-105996 Overview

CVE-2026-105996 affects the Booking Package WordPress plugin in versions prior to 1.7.31. The plugin generates booking cancellation tokens from values it exposes publicly rather than from a cryptographically secure source of randomness. An unauthenticated attacker can reconstruct the token for an arbitrary booking by deriving it from these public values. Successful reconstruction discloses personal data stored in the booking record. Where visitor cancellation is enabled, the attacker can also cancel the targeted booking without authentication. The weakness is classified under CWE-326: Inadequate Encryption Strength.

Critical Impact
Unauthenticated attackers can predict booking cancellation tokens, access personal data in booking records, and cancel bookings when visitor cancellation is enabled.

Affected Products

Booking Package WordPress plugin versions prior to 1.7.31
WordPress sites with the plugin installed and bookings enabled
WordPress sites with the plugin's visitor cancellation feature enabled (for the cancellation impact)

Discovery Timeline

2026-10-21 - CVE-2026-105996 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-105996

Vulnerability Analysis

The Booking Package plugin issues each booking a cancellation token used to authorize read and cancel operations without a login. The token is intended to act as a secret capability bound to a specific booking record. The plugin derives this token from booking attributes that are exposed through public endpoints rather than generating it from a secure random source. An attacker who can read the exposed values can replicate the derivation function and compute the same token the plugin would accept. Because the derivation is deterministic, every booking in the system becomes reachable through the same technique. The attacker then issues cancellation or view requests using the reconstructed token and the plugin treats the request as legitimate.

Root Cause

The root cause is improper cryptographic design, categorized as [CWE-326]. The plugin relies on predictable inputs instead of calling a cryptographically secure pseudo-random number generator such as random_bytes() or wp_generate_password() with sufficient entropy. Treating public identifiers as secret material violates the separation between authentication data and application metadata.

Attack Vector

The attack is executed over the network without authentication or user interaction. An attacker enumerates or observes booking identifiers through public plugin endpoints. The attacker reconstructs the cancellation token using the documented derivation inputs. The reconstructed token is then submitted to the plugin's cancellation or view endpoint to disclose personal data or cancel the booking. Full technical details are available in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-105996

Indicators of Compromise

Unexpected booking cancellations reported by customers with no corresponding admin or customer action in logs
High-volume requests to the plugin's cancellation or booking-view endpoints from a single source IP
Sequential or scripted access patterns across many booking identifiers in web server access logs
Spikes in cancellation emails sent from the WordPress mailer without matching customer sessions

Detection Strategies

Audit the installed version of the Booking Package plugin and flag any instance earlier than 1.7.31
Review web server logs for repeated requests to cancellation endpoints with varying booking identifiers
Compare booking state changes against authenticated admin sessions to identify cancellations lacking a user context
Correlate token-bearing requests with source IP reputation and geographic consistency for the booking owner

Monitoring Recommendations

Enable WordPress audit logging for booking create, update, and delete events with full request metadata
Rate-limit requests to the plugin's public endpoints at the web server or WAF layer
Alert on anomalous volumes of outbound cancellation notifications
Forward WordPress and web server logs to a centralized log platform for correlation and retention

How to Mitigate CVE-2026-105996

Immediate Actions Required

Update the Booking Package plugin to version 1.7.31 or later on every WordPress site where it is installed
Disable the visitor cancellation feature until the update is applied if immediate patching is not possible
Review recent bookings for unauthorized cancellations and notify affected customers
Rotate any booking identifiers or tokens that may have been exposed before the patch

Patch Information

The vendor fixed the issue in Booking Package version 1.7.31 by replacing the predictable token derivation with a secure random token generator. Site operators should install the update through the WordPress plugin management interface or via WP-CLI. Confirm the plugin version after the update and verify that existing bookings issue new, non-derivable tokens.

Workarounds

Disable visitor-initiated cancellation in the plugin settings to prevent the cancellation impact
Restrict access to the plugin's public cancellation endpoints with a web application firewall rule until the patch is applied
Require authenticated customer accounts for booking management where the plugin supports it

bash

# Update the Booking Package plugin using WP-CLI
wp plugin update booking-package --version=1.7.31
wp plugin get booking-package --field=version