WordPress Plugin Vulnerabilities

Booking Package < 1.7.31 - Unauthenticated Calendar Account Information Disclosure

Description

The plugin does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administrator's notification email addresses.

Proof of Concept

Affects Plugins

Plugin icon
booking-package
Fixed in 1.7.31

References

CVE
CVE-2026-105999

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Revanth Hari Narayana Matte
Submitter
Revanth Hari Narayana Matte
Verified
Yes
WPVDB ID
0fb34ecd-4b07-4279-a086-09d828a61788

Timeline

Publicly Published
2026-10-19 (about 2 days ago)
Added
2026-10-19 (about 1 day ago)
Last Updated
2026-10-19 (about 1 day ago)

Other

Published
Title
Published
2026-03-17
Title
Nelio AB Testing < 8.3.0 - Unauthenticated Information Exposure
Published
2024-07-10
Title
Recipe Maker For Your Food Blog from Zip Recipes <= 8.2.6 - Unauthenticated Sensitive Information Exposure
Published
2026-10-19
Title
WholesaleX < 3.0.9 - Unauthenticated Imported User CSV Disclosure
Published
2024-03-28
Title
Paid Memberships Pro – Payfast Gateway Add On < 1.4.2 - Unauthenticated Information Exposure
Published
2024-01-10
Title
WPS Hide Login < 1.9.12 - Hidden Login Page Location Disclosure