CVE-2026-105996CWE-326
CVE-2026-105996
Medium · published October 21, 2026
What it is
The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source of randomness, deriving them instead from values it exposes publicly, so an unauthenticated attacker can reconstruct an arbitrary booking's token, disclose that booking's personal data and, where visitor cancellation is enabled, cancel the booking.
The record
Technical detail
- CVSS v3.1
- 4.8 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00123 · 1.9th percentile
- Weakness
- CWE-326 · Inadequate Encryption Strength
- Published
- 2026-10-21T10:16Z
References (1)
EPSS history
Timeline
22 OCT 03:28Z
EPSS moved — → 0%
epss
21 OCT 06:00Z
Booking Package < 1.7.31 - Unauthenticated Booking PII Disclosure and Cancellation via Predictable Token
cvelistv5
21 OCT 06:00Z
Booking Package < 1.7.31 - Unauthenticated Booking PII Disclosure and Cancellation via Predictable Token
cvelistv5