---
id: CVE-2026-105995
title: >-
  The Booking Package WordPress plugin before 1.7.30 does not perform
  authorization checks before returning stored reservation data, allowing
  unauthenticated users to disclose other customers' personal information and
  booking cancellation …
summary: >-
  The Booking Package WordPress plugin before 1.7.30 does not perform
  authorization checks before returning stored reservation data, allowing
  unauthenticated users to disclose other customers' personal information and
  booking cancellation …
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-200
published: '2026-10-10'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T20:36:00.850'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-105995'
references:
  - url: 'https://wpscan.com/vulnerability/a778a758-4c44-45d6-bd34-9668bba2a95c/'
    label: contact@wpscan.com
tags:
  - nvd
  - cve.org
epss: 0.00251
epssPercentile: 0.1639
ingestedAt: '2026-10-10T06:24:42.864Z'
product: Booking Package
affected:
  - booking_package < 1.7.30
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-10T12:03:12.103068Z'
---

## Overview

The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose other customers' personal information and booking cancellation tokens.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.