Booking Package EUVD-2026-107056

No authentication, user interaction, or special configuration is required: any internet-reachable WordPress site running Booking Package before version 1.7.31 is exploitable by a remote unauthenticated attacker against default configurations, because the plugin omits an authorization check before returning calendar-account configuration data. The practical limiting factors are: the impact is confined to disclosure of configuration settings (primarily administrator notification email addresses) with no write access or code execution, and exploitation requires that the vulnerable plugin be installed and active and that the specific calendar-account configuration response actually contain populated sensitive values.

This is a genuinely moderate, not critical, issue and the signals are internally consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:L/I:N/A:N, 5.3 Medium) correctly reflects a remotely reachable, unauthenticated, low-complexity information disclosure with only limited confidentiality impact and no integrity or availability impact - matching the description of a missing authorization check that leaks calendar-account configuration. Publicly available exploit code exists (WPScan), which raises the practical likelihood of opportunistic mass-scanning against WordPress sites running this plugin, but there is NO CISA KEV listing and NO EPSS score provided in the input, so widespread active exploitation cannot be asserted. No SSVC decision data was supplied. The net picture is a low-effort, low-reward disclosure bug: easy to trigger but yielding only sensitive settings (notably administrator notification email addresses) rather than credentials, code execution, or data modification. Priority should be routine patching rather than emergency response - the disclosed emails are most useful as reconnaissance feeding phishing or targeted password attacks, not as a direct compromise vector.

An unauthenticated attacker sends a crafted HTTP request to the vulnerable plugin endpoint on a WordPress site running Booking Package before 1.7.31 and receives the calendar-account configuration in the response, including the administrator's notification email addresses. Because AC:L/PR:N/UI:N and public exploit code from WPScan exists, this can be automated across many sites at scale, with the harvested admin emails then fueling targeted phishing or credential-stuffing against the WordPress login.