CVE-2026-106000

UNKNOWN 0.0

Booking Package < 1.7.34 - Unauthenticated Payment Bypass

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The Booking Package WordPress plugin before 1.7.34 does not require payment to be completed before saving a booking on calendars configured to require online payment, allowing unauthenticated users to create confirmed bookings without paying.

Vendor	unknown
Product	booking package
Published	Nov 4, 2026

Stay Ahead of the Next One

Get instant alerts for unknown booking package

Be the first to know when new unknown vulnerabilities affecting unknown booking package are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / Booking Package

0 < 1.7.34

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/4a29bfc9-741e-417f-a382-ff9b77fb1571/

Credits

Revanth Hari Narayana Matte WPScan