CVE-2026-105996 Details
Description
The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source of randomness, deriving them instead from values it exposes publicly, so an unauthenticated attacker can reconstruct an arbitrary booking's token, disclose that booking's personal data and, where visitor cancellation is enabled, cancel the booking.
A vulnerability exists in the Booking Package WordPress plugin in versions prior to 1.7.31. The issue arises because the plugin does not use a secure source of randomness to generate booking cancellation tokens. Instead, it derives these tokens from publicly exposed values. This flaw allows an unauthenticated attacker to reconstruct a specific booking's token, access the associated personal data, and cancel the booking if visitor cancellation is enabled.
Users are advised to update the Booking Package WordPress plugin to version 1.7.31 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/ff7e2703-3949-43bc-a0b5-12ed49e5e396/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-326 | Inadequate Encryption Strength | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Booking Package | < 1.7.31 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 21, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | [email protected] |