Booking Package
Monthly
Unauthenticated PII disclosure in the Booking Package WordPress plugin through version 1.7.29 lets remote attackers retrieve the booking_package_booked_customers table, exposing customer names, email addresses, phone numbers, physical addresses, and cancellation tokens. The endpoint's only nominal protection is a nonce that the plugin emits in the public booking_package JavaScript object on any page rendering the [booking_package] shortcode or widget, so any visitor can harvest it and call the unauthorized retrieval path; no authentication, user interaction, or special configuration is required per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. No CISA KEV listing was provided, and no public exploit identified at time of analysis, and the assessed impact is confidentiality-only (I:N/A:N), making this an actionable priority for sites actively using the plugin but not a top-tier emergency.
Unauthenticated SQL injection in the Booking Package WordPress plugin (versions up to and including 1.7.20, by developer masaakitanaka) lets remote attackers append SQL to an existing query via the 'email' form parameter on the /wp-json/booking-package/v1/request REST endpoint, enabling extraction of sensitive database contents. The endpoint is registered with permission_callback __return_true and REST-sourced $_POST values bypass wp_magic_quotes, so single quotes reach the SQL sink without authentication. Exploitability is severely constrained because the parameter is filtered through WordPress's is_email() before use, and there is no public exploit identified at time of analysis.
Unauthenticated broken access control in the SaaSProject Booking Package WordPress plugin versions 1.7.06 and earlier allows remote attackers to invoke privileged plugin functionality without authentication, resulting in unauthorized modification of booking data (CVSS 7.5, integrity-only impact). The flaw is a CWE-862 Missing Authorization issue disclosed via Patchstack and tracked in ENISA EUVD as EUVD-2026-36983, with no public exploit identified at time of analysis.
Privilege escalation in the Booking Package plugin for WordPress (versions up to and including 1.7.16) allows authenticated attackers with Editor-level access or above to take over any account, including Administrator accounts, by abusing the 'updateUser' branch of the package_app_action AJAX endpoint. The handler validates only a nonce and passes a hard-coded administrator flag to Schedule::updateUser(), letting attackers supply arbitrary target user IDs to wp_update_user() and reset the email and password of any account. No public exploit identified at time of analysis, but the issue was disclosed by Wordfence and results in full site compromise once an Editor account is obtained.
Unauthenticated information disclosure in the WordPress Booking Package plugin before 1.7.31 exposes calendar-account configuration data, including administrator notification email addresses, to any remote attacker who can reach the site. The plugin returns these sensitive settings from a response handler without performing authorization checks, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms no credentials, interaction, or special configuration are needed. Publicly available exploit code exists and a vendor patch is available, but the impact is limited to confidentiality of configuration values with no write access or code execution, keeping overall risk moderate rather than critical.
Booking Package WordPress plugin before 1.7.31 allows unauthenticated remote attackers to reset its premium subscription state, disabling paid features on affected sites. The issue is a missing authorization and validity check in the subscription-reset code path, requiring no credentials or user interaction, and is limited to integrity impact on the plugin’s premium status. Publicly available exploit code exists, and the vendor has released version 1.7.31 to address the flaw; risk is bounded to sites actively using the paid tier.
Insecure cancellation-token generation in the Booking Package WordPress plugin before 1.7.31 allows unauthenticated attackers to reconstruct any booking's cancellation token from publicly exposed values, disclosing that booking's personal data and, when visitor cancellation is enabled, canceling the booking. Publicly available exploit code exists, and the CVSS 3.1 score is 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N), indicating moderate risk: disclosure works on default installs, while cancellation depends on the visitor-cancellation setting. No CISA KEV active-exploitation signal is present in the supplied data.
Stored cross-site scripting in the Booking Package WordPress plugin (versions up to and including 1.7.29) allows authenticated users with contributor-level access or higher to inject persistent JavaScript via the 'id' parameter, which executes when other users view the injected page. The flaw results from insufficient input sanitization and output escaping, and no public exploit has been identified at time of analysis. Exploitation requires an authenticated contributor account, and the impact is constrained to higher-privileged users who access the malicious content, making this a moderate-severity issue.
Payment amount manipulation in the Booking Package WordPress plugin (versions before 1.7.25) allows unauthenticated remote attackers to complete paid service bookings at an arbitrary fraction of the legitimate price. The plugin derives the charge amount from attacker-controlled HTTP request values rather than authoritative server-stored pricing, a classic business-logic trust boundary failure. A publicly available exploit exists per WPScan, though no CISA KEV listing was provided in input data, and EPSS at 0.18% (7th percentile) suggests limited observed mass exploitation to date.
Booking Package plugin for WordPress up to version 1.7.06 allows unauthenticated attackers to manipulate booking prices via the intentForStripe() function, which accepts unsanitized $_POST['amount'] values and passes them directly to the Stripe PaymentIntent API without validation. The vulnerability is compounded by commented-out code in CreditCard.php that would normally enforce server-calculated pricing, enabling attackers to complete bookings at arbitrary prices (e.g., $0.01 instead of $500.00) with no authentication required. This is a confirmed price manipulation vulnerability with no active KEV exploitation reported but represents significant financial fraud risk.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Booking Package WordPress plugin before 1.5.29 requires a token for exporting the ical representation of it's booking calendar, but this token is returned in the json response to unauthenticated. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting vulnerability in Booking Package - Appointment Booking Calendar System versions prior to 1.5.11 allows a remote attacker to inject an arbitrary script via unspecified vectors. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauthenticated PII disclosure in the Booking Package WordPress plugin through version 1.7.29 lets remote attackers retrieve the booking_package_booked_customers table, exposing customer names, email addresses, phone numbers, physical addresses, and cancellation tokens. The endpoint's only nominal protection is a nonce that the plugin emits in the public booking_package JavaScript object on any page rendering the [booking_package] shortcode or widget, so any visitor can harvest it and call the unauthorized retrieval path; no authentication, user interaction, or special configuration is required per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. No CISA KEV listing was provided, and no public exploit identified at time of analysis, and the assessed impact is confidentiality-only (I:N/A:N), making this an actionable priority for sites actively using the plugin but not a top-tier emergency.
Unauthenticated SQL injection in the Booking Package WordPress plugin (versions up to and including 1.7.20, by developer masaakitanaka) lets remote attackers append SQL to an existing query via the 'email' form parameter on the /wp-json/booking-package/v1/request REST endpoint, enabling extraction of sensitive database contents. The endpoint is registered with permission_callback __return_true and REST-sourced $_POST values bypass wp_magic_quotes, so single quotes reach the SQL sink without authentication. Exploitability is severely constrained because the parameter is filtered through WordPress's is_email() before use, and there is no public exploit identified at time of analysis.
Unauthenticated broken access control in the SaaSProject Booking Package WordPress plugin versions 1.7.06 and earlier allows remote attackers to invoke privileged plugin functionality without authentication, resulting in unauthorized modification of booking data (CVSS 7.5, integrity-only impact). The flaw is a CWE-862 Missing Authorization issue disclosed via Patchstack and tracked in ENISA EUVD as EUVD-2026-36983, with no public exploit identified at time of analysis.
Privilege escalation in the Booking Package plugin for WordPress (versions up to and including 1.7.16) allows authenticated attackers with Editor-level access or above to take over any account, including Administrator accounts, by abusing the 'updateUser' branch of the package_app_action AJAX endpoint. The handler validates only a nonce and passes a hard-coded administrator flag to Schedule::updateUser(), letting attackers supply arbitrary target user IDs to wp_update_user() and reset the email and password of any account. No public exploit identified at time of analysis, but the issue was disclosed by Wordfence and results in full site compromise once an Editor account is obtained.
Unauthenticated information disclosure in the WordPress Booking Package plugin before 1.7.31 exposes calendar-account configuration data, including administrator notification email addresses, to any remote attacker who can reach the site. The plugin returns these sensitive settings from a response handler without performing authorization checks, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms no credentials, interaction, or special configuration are needed. Publicly available exploit code exists and a vendor patch is available, but the impact is limited to confidentiality of configuration values with no write access or code execution, keeping overall risk moderate rather than critical.
Booking Package WordPress plugin before 1.7.31 allows unauthenticated remote attackers to reset its premium subscription state, disabling paid features on affected sites. The issue is a missing authorization and validity check in the subscription-reset code path, requiring no credentials or user interaction, and is limited to integrity impact on the plugin’s premium status. Publicly available exploit code exists, and the vendor has released version 1.7.31 to address the flaw; risk is bounded to sites actively using the paid tier.
Insecure cancellation-token generation in the Booking Package WordPress plugin before 1.7.31 allows unauthenticated attackers to reconstruct any booking's cancellation token from publicly exposed values, disclosing that booking's personal data and, when visitor cancellation is enabled, canceling the booking. Publicly available exploit code exists, and the CVSS 3.1 score is 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N), indicating moderate risk: disclosure works on default installs, while cancellation depends on the visitor-cancellation setting. No CISA KEV active-exploitation signal is present in the supplied data.
Stored cross-site scripting in the Booking Package WordPress plugin (versions up to and including 1.7.29) allows authenticated users with contributor-level access or higher to inject persistent JavaScript via the 'id' parameter, which executes when other users view the injected page. The flaw results from insufficient input sanitization and output escaping, and no public exploit has been identified at time of analysis. Exploitation requires an authenticated contributor account, and the impact is constrained to higher-privileged users who access the malicious content, making this a moderate-severity issue.
Payment amount manipulation in the Booking Package WordPress plugin (versions before 1.7.25) allows unauthenticated remote attackers to complete paid service bookings at an arbitrary fraction of the legitimate price. The plugin derives the charge amount from attacker-controlled HTTP request values rather than authoritative server-stored pricing, a classic business-logic trust boundary failure. A publicly available exploit exists per WPScan, though no CISA KEV listing was provided in input data, and EPSS at 0.18% (7th percentile) suggests limited observed mass exploitation to date.
Booking Package plugin for WordPress up to version 1.7.06 allows unauthenticated attackers to manipulate booking prices via the intentForStripe() function, which accepts unsanitized $_POST['amount'] values and passes them directly to the Stripe PaymentIntent API without validation. The vulnerability is compounded by commented-out code in CreditCard.php that would normally enforce server-calculated pricing, enabling attackers to complete bookings at arbitrary prices (e.g., $0.01 instead of $500.00) with no authentication required. This is a confirmed price manipulation vulnerability with no active KEV exploitation reported but represents significant financial fraud risk.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Booking Package WordPress plugin before 1.5.29 requires a token for exporting the ical representation of it's booking calendar, but this token is returned in the json response to unauthenticated. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting vulnerability in Booking Package - Appointment Booking Calendar System versions prior to 1.5.11 allows a remote attacker to inject an arbitrary script via unspecified vectors. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.