Booking Package EUVD-2026-100762

Exploitation requires only that the target site runs Booking Package ≤1.7.29 AND publishes at least one public page containing the [booking_package] shortcode or widget, which emits the harvestable public nonce needed to call the unauthorized endpoint - a condition met by essentially any live installation that actually uses the plugin for bookings. No authentication, user interaction, or non-default configuration is required (AV:N/AC:L/PR:N/UI:N). The only practical limiting factors are that the plugin must be installed and actively used to render a booking page, and that impact is confined to disclosure of stored customer PII (names, emails, phone numbers, addresses, cancellation tokens) with no write or availability effect (I:N/A:N).

This is a genuine, actionable priority for sites running the affected plugin, though not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, fully unauthenticated flaw with high confidentiality impact (C:H) and no integrity or availability impact - consistent with CWE-862 (Missing Authorization) and the description's claim that unauthenticated visitors can dump the entire booking_package_booked_customers table of PII. The signals are coherent rather than conflicting: a broken-access-control information disclosure legitimately scores 7.5 with C:H/I:N/A:N. However, key exploitation-likelihood signals are MISSING from the input: no EPSS probability was provided, the vulnerability is NOT listed in CISA KEV, and no public proof-of-concept is referenced (only Wordfence's advisory and source-code trac links). The description notably weakens the only apparent barrier - it states the protecting nonce is a public CSRF token harvestable from any page with the [booking_package] shortcode - meaning real-world exploitation is trivial for any attacker who finds a vulnerable site, so the true risk is bounded mainly by how widely the plugin is deployed rather than by attack difficulty. Treat as a high-confidence data-breach exposure where present; prioritize patching for any site holding customer PII.

An unauthenticated attacker loads any public page of a target WordPress site that renders the [booking_package] shortcode or widget, scrapes the public nonce from the localized booking_package JavaScript object, then replays it to the vulnerable AJAX endpoint to download every booked customer's name, email, phone, address, and cancellation token. No login, user interaction, or special privileges are required. No public exploit is referenced in the input, but the attack is described as trivially reproducible.