Ettrick Booking CVE-2026-105992

No authentication, user interaction, or special privileges are required (PR:N/UI:N): any remote actor who can reach the plugin's booking workflow on a vulnerable site can abuse it. The specific precondition is simply that the site runs Ettrick Escape Room Booking before version 1.3.1 with its booking/payment-confirmation functionality enabled (the plugin's core purpose, so effectively default). The limiting factor on real-world impact is scope rather than difficulty: exploitation only forges payment/confirmation state for bookings on that plugin - it does not yield code execution, data disclosure, or site takeover - so damage is confined to fraudulent bookings and associated revenue loss.

This is a medium-severity (CVSS 5.3) authorization/business-logic flaw whose signals are internally consistent but modest. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no user interaction, and the impact is scoped to integrity only (C:N/I:L/A:N) - an attacker can forge a 'paid' status but cannot read data or crash the service. Publicly available exploit code exists (WPScan), which raises real-world likelihood above a theoretical issue, but there is NO CISA KEV listing and NO EPSS score provided in the input, so widespread automated exploitation cannot be confirmed or quantified from available data. The business impact (fraudulent free bookings / revenue loss) can be significant for an affected operator even though the technical CVSS impact is only 'Low' integrity. Net: a credible, easy-to-abuse flaw worth prompt patching for anyone running this plugin, but not an emergency-tier issue in the broader threat landscape given its niche footprint and absence of confirmed active exploitation.

An unauthenticated attacker initiates a booking on a site running Ettrick Escape Room Booking before 1.3.1, then directly triggers the booking-confirmation flow without completing payment at the provider. Because the plugin never validates the payment status against the payment provider, the booking is marked paid and confirmed, granting a free reservation. Public exploit code for this flaw is available via WPScan, lowering the skill needed to reproduce it.