CVE-2026-105998 — Booking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing Authorization
The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated…
Published: 2026-10-21 · CVSS: 5.3 · CVSS 3.1
The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7