Booking Package
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:booking_package:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Booking Package (c50424d1-133d-5622-97fd-e8d07142745b) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-105998 |
vulnerable | 2026-11-03 10:16:33.341710 |
Booking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing Authorization
The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features.
Published: 2026-10-21T06:00:18.969Z
Updated: 2026-10-21T10:35:07.028Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-105999 |
vulnerable | 2026-11-03 10:16:33.222803 |
Booking Package < 1.7.31 - Unauthenticated Calendar Account Information Disclosure
The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administrator's notification email addresses.
Published: 2026-10-21T06:00:19.187Z
Updated: 2026-10-21T10:35:06.560Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-105997 |
vulnerable | 2026-11-03 10:16:33.175450 |
Booking Package < 1.7.33 - Unauthenticated Verification Email Sending to Arbitrary Recipient
The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recipient to server-side state, allowing unauthenticated users to make the site send templated verification-code emails to arbitrary recipients.
Published: 2026-10-28T06:00:21.342Z
Updated: 2026-10-28T17:58:08.731Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-105996 |
vulnerable | 2026-11-03 10:16:33.012054 |
Booking Package < 1.7.31 - Unauthenticated Booking PII Disclosure and Cancellation via Predictable Token
The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source of randomness, deriving them instead from values it exposes publicly, so an unauthenticated attacker can reconstruct an arbitrary booking's token, disclose that booking's personal data and, where visitor cancellation is enabled, cancel the booking.
Published: 2026-10-21T06:00:18.712Z
Updated: 2026-10-21T10:35:07.631Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.