CVE-2026-105999: Booking Package WordPress Information Disclosure

CVE-2026-105999 Overview

CVE-2026-105999 is an information disclosure vulnerability in the Booking Package WordPress plugin versions prior to 1.7.31. The plugin fails to perform authorization checks before returning calendar-account configuration data in an API response. Unauthenticated remote attackers can retrieve sensitive settings, including the administrator's notification email addresses. The flaw is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. While the vulnerability does not permit code execution or data modification, exposed email addresses can seed targeted phishing campaigns against site administrators.

Critical Impact
Unauthenticated attackers can harvest administrator notification email addresses and calendar-account configuration from vulnerable WordPress sites without authentication or user interaction.

Affected Products

Booking Package WordPress plugin versions prior to 1.7.31
WordPress sites running the plugin with default configuration
Any site exposing the plugin's calendar-account endpoint to the public internet

Discovery Timeline

2026-10-21 - CVE-2026-105999 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-105999

Vulnerability Analysis

The Booking Package plugin exposes a calendar-account configuration endpoint that returns stored settings in its response payload. The handler returns the configuration without validating whether the requesting user holds an administrative role or any WordPress capability. Any unauthenticated client that reaches the endpoint receives the raw configuration data in the response body.

The disclosed data includes the administrator notification email addresses used by the plugin to deliver booking alerts. Attackers can enumerate vulnerable sites, retrieve these addresses, and feed them into phishing, credential-stuffing, or business email compromise workflows targeted at site operators.

Root Cause

The root cause is a missing authorization check [CWE-200] in the request handler that serves calendar-account settings. The plugin treats the endpoint as public data retrieval rather than an administrative read operation. No current_user_can() capability check or nonce validation gates the response, so the handler returns the configuration to any caller.

Attack Vector

Exploitation requires only network access to the WordPress site. An attacker sends a crafted HTTP request to the vulnerable endpoint exposed by the Booking Package plugin. The server responds with calendar-account configuration data, including administrator email addresses. No credentials, user interaction, or elevated privileges are needed. See the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-105999

Indicators of Compromise

Unauthenticated HTTP requests to Booking Package plugin endpoints that return JSON payloads containing email addresses or account configuration fields.
Repeated access to the plugin's admin-ajax.php or REST API routes from unauthenticated clients across short time windows.
Subsequent targeted phishing emails arriving at administrator notification addresses that are not publicly listed elsewhere on the site.

Detection Strategies

Review web server access logs for anonymous requests to Booking Package plugin endpoints that return 200 status codes with non-empty response bodies.
Deploy web application firewall rules that identify response bodies containing email, account, or configuration keys returned to unauthenticated sessions.
Correlate plugin version data from WordPress inventory scans with the vulnerable range below 1.7.31 to prioritize affected hosts.

Monitoring Recommendations

Monitor for spikes in traffic to the Booking Package plugin's AJAX or REST endpoints from external IP addresses.
Alert on inbound phishing attempts to administrator notification mailboxes following known exposure windows.
Track plugin update status across managed WordPress estates to confirm remediation progress.

How to Mitigate CVE-2026-105999

Immediate Actions Required

Update the Booking Package WordPress plugin to version 1.7.31 or later on all affected sites.
Rotate or change administrator notification email addresses if site exposure is suspected and phishing risk is elevated.
Audit recent access logs for unauthenticated requests to plugin endpoints and preserve evidence of any configuration disclosure.

Patch Information

The vendor addressed CVE-2026-105999 in Booking Package version 1.7.31 by adding authorization checks before returning calendar-account configuration. Administrators should upgrade through the WordPress plugin dashboard or deploy the updated package through their standard release process. Refer to the WPScan advisory for vendor references.

Workarounds

Restrict access to WordPress AJAX and REST API endpoints used by the Booking Package plugin via web application firewall rules until the patch is applied.
Temporarily deactivate the Booking Package plugin on sites that cannot be updated immediately.
Place the WordPress admin surface behind IP allowlisting or authenticated reverse-proxy controls to reduce exposure of plugin endpoints.

bash

# Example WAF rule concept to block unauthenticated access to the vulnerable action
# Adjust action name to the specific endpoint identified in the plugin version in use
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,deny,status:403,id:1050999,msg:'Block unauth Booking Package calendar-account access'"
    SecRule ARGS:action "@rx booking_package_(get|calendar|account)" \
        "chain"
        SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"