Unrated severityNVD Advisory· Published Oct 21, 2026

CVE-2026-105998

Description

The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features.

Affected products

WordPress/Booking Packagellm-fuzzy
Range: <1.7.31
Package: https://wordpress.org/plugins/booking-package

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/feb9d9bd-7192-4c75-9dc4-43d925518dc1/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000