Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Booking Package 1.7.31 Clear all filters
TI-2026-78602 CVE-2026-105999 · GHSA-67j7-p28r-v995

Sensitive calendar account data exposed in Booking Package plugin

Priority LOW 30

The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings includ…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00333 Published 2026-10-21 Fixed in 1.7.31 CWE-200
TI-2026-78601 CVE-2026-105998 · GHSA-77hv-2363-j2hj

Missing authorization in Booking Package lets attackers disable paid features

Priority LOW 30

The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package W…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00293 Published 2026-10-21 Fixed in 1.7.31 CWE-862
TI-2026-78600 CVE-2026-105996 · GHSA-85q6-jvxh-6w5f

Predictable cancellation tokens in Booking Package expose booking data

Priority LOW 21

The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source of randomness, deriving them instead from values it exposes publicly, so an unauthenticated attacker…

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00153 Published 2026-10-21 Fixed in 1.7.31 CWE-326