Booking Package CVE-2026-40774

No special conditions - remote unauthenticated exploitation against default configurations of the SaaSProject Booking Package WordPress plugin at version 1.7.06 or earlier, with the plugin installed and activated on an internet-reachable WordPress site. The limiting factors are: the vulnerable plugin must be installed and active (it is not a core WordPress flaw), the site must expose wp-admin/admin-ajax.php or the WordPress REST API to the internet (the default for public WordPress installations), and impact is confined to integrity of booking data (no read access to other site data, no code execution, no denial of service per the CVSS C:N/A:N metrics).

The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N indicates a remote, low-complexity, unauthenticated attack with high integrity impact but no confidentiality or availability loss - consistent with an attacker able to create, modify, or delete booking records without reading sensitive data. EPSS, KEV, and POC data are not provided in the input, so real-world exploitation pressure cannot be quantified; however, broken access control bugs in WordPress plugins historically see rapid mass-scanning once Patchstack details are public. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV based on available data, suggesting opportunistic rather than confirmed targeted exploitation. The integrity-only impact means the practical risk is tampering with bookings (fraudulent reservations, deletion of legitimate appointments) rather than data theft or site takeover.

A remote attacker sends crafted HTTP POST requests directly to the WordPress site's admin-ajax.php (or REST API) targeting the Booking Package plugin's vulnerable action without authenticating, and the plugin executes the privileged booking operation because the authorization check is missing. The attacker uses this to fabricate or cancel bookings at scale, disrupting business operations or committing reservation fraud. No public exploit identified at time of analysis, but the low-complexity unauthenticated nature makes exploit development trivial once a researcher inspects the plugin source.