EUVD-2026-96125
GHSA-hhf8-8xcf-35xv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach plugin reservation endpoint
-
ExploitSend unauthenticated data request
-
ExecutionEnumerate stored reservation records
-
ImpactHarvest customer PII and cancellation tokens
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special configuration is required: exploitation needs only a WordPress site running the Booking Package plugin at a version before 1.7.30 with stored reservations present, reached over the network by an unauthenticated attacker (AV:N/PR:N/UI:N). The practical limiting factors are that the target must have the vulnerable plugin installed and active and must hold booking records for data to be disclosed; impact is restricted to confidentiality of reservation data and cancellation tokens, with no direct code execution, data modification, or service disruption. |
| Impact | Signals are consistent and point to a moderate, not critical, priority. The CVSS 3.1 base score is 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N - network-reachable, low-complexity, and crucially unauthenticated (PR:N), which lowers the barrier to exploitation. However, impact is confined to confidentiality at Low (C:L/I:N/A:N): no integrity or availability loss. No EPSS score was supplied in the input, there is no CISA KEV listing, and no public proof-of-concept is referenced, so there is no evidence of active or at-scale exploitation. The disclosed data - other customers' PII and booking cancellation tokens - is sensitive, and the cancellation tokens are an aggravating factor because they could enable unauthorized cancellation of other customers' reservations (a downstream integrity effect not captured in the C-only base vector). Net: a genuine unauthenticated information-disclosure flaw worth patching promptly for exposed WordPress sites, but not an emergency relative to RCE or auth-bypass classes. No signals conflict; the main gap is the absence of EPSS/POC/exploitation telemetry in the provided data. |
| Exploit ScenarioDerived | An unauthenticated attacker sends requests to the vulnerable Booking Package plugin endpoint that returns stored reservation data without an authorization check, enumerating records to harvest other customers' personal information and their booking cancellation tokens. With the cancellation tokens, the attacker could then cancel victims' bookings. No public exploit code is referenced in the input, but the flaw is low-complexity and requires no authentication or user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated information disclosure in the Booking Package WordPress plugin before 1.7.30 lets remote attackers retrieve other customers' stored reservation details and booking cancellation tokens because the data-returning endpoint omits authorization checks. Any WordPress site running the affected plugin with stored reservations is exposed over the network without credentials, though impact is confined to confidentiality and availability/integrity are unaffected (CVSS 5.3, CWE-200). No public exploit code or confirmed active exploitation was identified in the available intelligence.
RemediationAI
Upgrade the Booking Package plugin to version 1.7.30 or later, which is the vendor-released fixed version; the patch is available per the vendor advisory at https://wpscan.com/vulnerability/a778a758-4c44-45d6-bd34-9668bba2a95c/. If immediate upgrade is not possible, deactivate the plugin until patching can be performed, accepting the loss of booking functionality. Alternatively, place a WAF rule or reverse-proxy restriction in front of the endpoint that returns reservation data to block unauthenticated requests to the relevant admin-ajax.php action or REST route, but this requires identifying the exact route and may break legitimate booking pages for guests. Because cancellation tokens may already have been exposed on unpatched sites, consider invalidating or rotating outstanding booking tokens and notifying affected customers if unauthorized access is suspected; disabling the plugin is the most reliable compensating control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Booking Package plugin for WordPress exposes reservation data through a request handler that fails to enforce authorization before returning stored records. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) captures the root cause: the code path that reads booking records does not verify that the requester owns the reservation, holds an administrative capability, or presents a valid nonce. WordPress plugins commonly expose such handlers via admin-ajax.php actions or REST routes, and without capability checks or ownership validation any unauthenticated visitor can enumerate booking IDs or parameters to pull other customers' personal information and cancellation tokens. The tokens are security-relevant because they likely authorize booking cancellation or modification, so their disclosure can enable follow-on abuse of other users' reservations even though the immediate vulnerability does not permit code execution or data modification.
Know when WordPress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Missing authorization check allows unauthenticated network access (AV:N/PR:N) with low complexity; impact is confidentiality-only disclosure of booking data (C:L), no integrity or availability effect.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
4DescriptionCVE.org
The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose other customers' personal information and booking cancellation tokens.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Exploit-DB