CVE-2026-105998
Booking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing Authorization
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features.
| Vendor | unknown |
| Product | booking package |
| Published | Oct 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown booking package
Be the first to know when new unknown vulnerabilities affecting unknown booking package are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Booking Package
0 < 1.7.31
References
Credits
Md. Minaruzzaman Shovon WPScan