TI-2026-73813 Aliases CVE-2026-103423 GHSA-p9r9-6j46-v8mh

Missing authorization in Booking Package exposes customer data

LOW 39CWE-862Published 2026-10-14 · Updated 2026-10-14

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

The Booking Package plugin for WordPress, all versions up to and including 1.7.29, does not verify that a user is authorized to perform an action (CWE-862). An unauthenticated attacker can retrieve personal data of every booked customer, including names, email addresses, phone numbers, physical addresses and cancellation tokens. The nonce meant to protect the endpoint is published on any page that renders the plugin's shortcode or widget, so it provides no real barrier.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.29 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve personally identifiable information for every booked customer stored in the booking_package_booked_customers table, including names, email addresses, phone numbers, physical addresses, and cancellation tokens. The nonce nominally protecting the endpoint is a public CSRF token emitted in the localized booking_package JavaScript object on any page rendering the [booking_package] shortcode or widget, making it trivially harvestable by unauthenticated visitors and providing no effective authentication barrier.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0053 45th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
masaakitanaka	Booking Package	up to 1.7.29	—	No fix listed	CNA

Booking Package Vendormasaakitanaka Affected up to 1.7.29 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Booking Package.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

2026-10-14 Threatist record created from CVE-2026-103423
2026-10-14 Alias added: GHSA-p9r9-6j46-v8mh
2026-10-14 Priority changed: MEDIUM → LOW
2026-10-15 CISA SSVC decision points changed

References

Other 7

TI-2026-12907 Booking Package <= 1.7.20 - Unauthenticated SQL Injection via 'email' Form Parameter CVSS 3.1HIGH 7.5
TI-2026-08620 Booking Package <= 1.7.16 - Authenticated (Editor+) Privilege Escalation via Account Takeover to updateUser AJAX Action CVSS 3.1HIGH 7.2
TI-2026-04281 Booking Package <= 1.7.06 - Unauthenticated Price Manipulation via 'amount' Parameter CVSS 3.1MEDIUM 5.3
TI-2026-73814 Stored cross-site scripting in Booking Package WordPress plugin CVSS 3.1MEDIUM 6.4
TI-2024-12549 Booking Package <= 1.6.72 - Reflected Cross-Site Scripting via Locale Parameter CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences