CVE-2026-105999

The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administrator's notification email addresses.

CVSS 3.1

5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.3% chance of exploitation in the next 30 days; higher than 26% of CVEs (scores of 2026-10-25)

CWE

CWE-200

Published

2026-10-21

Modified

2026-10-21

Record from

the NVD, synced 2026-10-22

References

• https://wpscan.com/vulnerability/0fb34ecd-4b07-4279-a086-09d828a61788/

Check your stackJSON