Booking Package CVE-2026-105996

Information disclosure requires no special configuration - any booking's cancellation token can be reconstructed by an unauthenticated attacker from values the plugin exposes publicly, on default installs of the Booking Package plugin at versions below 1.7.31. The booking-cancellation (integrity) impact is gated on a specific setting: the 'visitor cancellation' feature must be enabled; with it disabled, exploitation is limited to reading a booking's personal data. The practical limiting factor is attack complexity (CVSS AC:H): the attacker must correctly derive the token from the exposed values rather than guess it blindly, so success depends on reproducing the (now publicly documented) derivation logic. No authentication and no user interaction are required (PR:N/UI:N).

This is a moderate, not high-priority, issue and the signals are internally consistent rather than conflicting. The CVSS 3.1 base score of 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) describes a network-reachable, unauthenticated flaw with only LOW confidentiality and LOW integrity impact and no availability impact - meaning data exposure of a single booking and the ability to cancel it, not full account or site compromise. The AC:H rating is the key dampener: although the token is derived from publicly exposed values (CWE-326, inadequate randomness), reconstructing an arbitrary booking's token still requires the attacker to correctly model and compute the derivation, so it is not a trivial one-shot request. Publicly available exploit code exists (WPScan), which raises practical risk because the derivation method is likely documented, but this is NOT the same as active exploitation. No CISA KEV listing and no EPSS score were provided in the input, so there is no evidence of in-the-wild or widespread automated exploitation - absence of those signals, combined with the limited per-booking impact, points to a low-urgency patch item for most sites. The integrity half of the impact (booking cancellation) only applies 'where visitor cancellation is enabled,' so on default or hardened configurations the realistic impact collapses to information disclosure of booking PII. Net: a legitimate privacy/data-exposure bug worth patching, but not a critical or emergency-grade vulnerability.

An unauthenticated attacker observes the publicly exposed values the plugin uses and computes the cancellation token for a target booking, then retrieves that booking's personal data (name, contact details, appointment info) via the cancellation endpoint. If the site has visitor cancellation enabled, the same reconstructed token lets the attacker cancel the victim's booking. Public exploit code from WPScan is available, lowering the effort to reproduce the token-derivation technique.