MEDIUM 5.3 NVD

CVE-2026-105995

The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated user

The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose other customers' personal information and booking cancellation tokens.

References

https://wpscan.com/vulnerability/a778a758-4c44-45d6-bd34-9668bba2a95c/

Published: 2026-10-10 · Source: NVD · Feed updated: 2026-10-12

This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-10-10 via NVD.

vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.