CVE-2026-105998
Unauthenticated Premium Subscription State Reset in Booking Package
CVSS 5.3 / 10
Summary
A Missing Authorization vulnerability exists in the WordPress Booking Package plugin in versions prior to 1.7.31. The plugin does not perform any authorization or validity check before resetting its premium subscription state.
An unauthenticated attacker can trigger the reset and disable the plugin's paid features, without needing any account on the site.
Technical Details
The premium subscription reset action accepts requests without verifying that the requester is authorized or that the reset is valid. No authentication is required to reach it.
Attack vector: Unauthenticated request that resets the Booking Package premium subscription state.
Impact
- Paid and premium features disabled without authorization
- Loss of premium functionality for site owners
- Service disruption for booking operations relying on paid features
Remediation
Update Booking Package to version 1.7.31 or later.