CVE-2026-105998 Overview
CVE-2026-105998 affects the Booking Package WordPress plugin in versions before 1.7.31. The plugin fails to perform authorization or validity checks before resetting its premium subscription state. Unauthenticated attackers can abuse this flaw to disable the paid features of the plugin on affected WordPress sites.
The weakness is classified as Missing Authorization [CWE-862]. The vulnerability is exploitable over the network without authentication or user interaction, but impact is limited to integrity of the plugin's subscription state.
Critical Impact
Unauthenticated remote attackers can reset the premium subscription state of the Booking Package plugin, disabling paid booking functionality on affected WordPress sites.
Affected Products
- Booking Package WordPress plugin versions prior to 1.7.31
- WordPress sites with the Booking Package plugin installed and activated
- Sites relying on the premium subscription features of Booking Package
Discovery Timeline
- 2026-10-21 - CVE-2026-105998 published to the National Vulnerability Database
- 2026-10-21 - Last updated in NVD database
Technical Details for CVE-2026-105998
Vulnerability Analysis
The Booking Package plugin exposes functionality that resets its premium subscription state. The handler that processes this reset operation does not verify the caller's identity, capability, or request validity. As a result, any unauthenticated visitor can invoke the reset routine over the network.
The exploit does not expose sensitive data and does not render the host unavailable. Instead, it modifies internal plugin state, disabling features that site owners have paid for. Site administrators may observe a sudden loss of premium booking capabilities without clear logs attributing the change to a legitimate user.
See the WPScan Vulnerability Analysis for additional technical context.
Root Cause
The root cause is Missing Authorization [CWE-862]. The subscription reset code path lacks a current_user_can() capability check, a nonce verification, or any equivalent gatekeeping before performing the state change. The plugin treats the reset action as public, which allows the state transition to occur from any origin.
Attack Vector
Attackers send a crafted HTTP request to the vulnerable endpoint exposed by the Booking Package plugin. No credentials, cookies, or user interaction are required. Automated scanners can discover and trigger the endpoint across many sites in a single pass, making opportunistic exploitation plausible once the endpoint is public knowledge.
// No verified proof-of-concept code is published.
// Refer to the WPScan advisory for request-level technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-105998
Indicators of Compromise
- Unexpected loss of premium Booking Package features without an administrator-initiated change
- HTTP requests from unauthenticated sources targeting Booking Package plugin endpoints associated with subscription state
- Database rows in plugin option tables showing subscription state reset to default values outside normal admin activity
Detection Strategies
- Review web server access logs for unauthenticated POST or GET requests to admin-ajax.php or REST routes handled by the Booking Package plugin
- Compare plugin option values (subscription keys, premium flags) against known-good baselines on a scheduled basis
- Alert on changes to plugin configuration state that occur without a corresponding authenticated administrator session
Monitoring Recommendations
- Forward WordPress audit logs and web server access logs into a centralized logging platform for correlation
- Monitor for repeated requests from a single source to Booking Package endpoints, which may indicate scripted exploitation
- Track plugin version inventory across WordPress estates to confirm all sites run version 1.7.31 or later
How to Mitigate CVE-2026-105998
Immediate Actions Required
- Upgrade the Booking Package WordPress plugin to version 1.7.31 or later on all affected sites
- Audit the current plugin subscription state and restore premium configuration if a reset is detected
- Restrict administrative endpoints behind a web application firewall where feasible
Patch Information
The vendor fixed the issue in Booking Package version 1.7.31 by adding authorization and validity checks before the subscription reset routine executes. Site administrators should update through the WordPress plugin manager or by replacing the plugin files with the patched release. Refer to the WPScan Vulnerability Analysis for version and fix references.
Workarounds
- Deactivate the Booking Package plugin until the patch can be applied if premium functionality is business-critical
- Block unauthenticated access to the vulnerable plugin endpoints at the web application firewall or reverse proxy layer
- Enforce IP allow-listing for administrative paths on sites that cannot immediately patch
# Example: update the Booking Package plugin via WP-CLI
wp plugin update booking-package --version=1.7.31
wp plugin list --name=booking-package --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
