CVE-2026-105992 — Ettrick Escape Room Booking < 1.3.1 - Unauthenticated Payment Confirmation Bypass
The Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not verify a booking's payment status against the payment provider before marking it paid and confirmed, allow…
Published: 2026-10-21 · CVSS: 5.3 · CVSS 3.1
The Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not verify a booking's payment status against the payment provider before marking it paid and confirmed, allowing unauthenticated attackers to mark bookings as paid without paying.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7