Booking Package CVE-2026-105998

Exploitation requires only that the target site runs the Booking Package WordPress plugin at a version before 1.7.31 with its premium/paid features in use; the vulnerable subscription-reset code path performs no authorization or validity check, so no authentication, no user interaction, and no non-default configuration are needed (PR:N/UI:N). The practical limiting factor is impact scope rather than access: the attack only resets premium subscription state to disable paid features and cannot read data, alter bookings' confidentiality, or take the site offline. Realistic risk is therefore bounded to sites actually relying on the plugin's paid tier.

All signals point to a genuine but low-severity, limited-impact vulnerability rather than a high-priority emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no user interaction, which maximizes exploitability, but the impact metrics (C:N/I:L/A:N) are deliberately modest: the only consequence is an integrity change (resetting the premium subscription state to disable paid features), with no confidentiality or availability loss and an unchanged scope. This yields the 5.3 MEDIUM score and matches CWE-862 (Missing Authorization). Publicly available exploit code exists (WPScan), which raises the practical likelihood of opportunistic abuse, but the vulnerability is NOT in CISA KEV and no EPSS probability was supplied, so there is no evidence of active, widespread exploitation. No SSVC decision data was provided. In short: easy to trigger but low-value to an attacker (it sabotages a site's paid features rather than granting data access or code execution), so treat as a routine patch priority, not a critical incident. EPSS and KEV data are both absent/negative, consistent with a nuisance-grade flaw rather than a mass-exploited one.

A remote, unauthenticated attacker sends a crafted request to a vulnerable WordPress site running Booking Package before 1.7.31, invoking the subscription-reset function that lacks any authorization or validity check. This resets the plugin's premium subscription state and disables the site's paid booking features, degrading functionality for the site operator. Public exploit code is available via WPScan, lowering the skill barrier to abuse.