CVE-2026-40774

Vulnerability

The Booking Package plugin for WordPress versions 1.7.06 and earlier suffer from an unauthenticated broken access control vulnerability. This means the plugin fails to properly enforce authorization, authentication, or nonce token checks in certain functions, allowing requests without proper credentials to reach privileged actions [1].

Exploitation

An attacker needs only network access to a site running the vulnerable plugin. No authentication or user interaction is required. The attacker can directly send crafted HTTP requests to the vulnerable endpoints, exploiting the missing access control to execute functions normally restricted to higher-privileged users [1].

Impact

Successful exploitation allows an unprivileged attacker to perform actions that should require higher privileges. This could lead to unauthorized modification of settings, data exposure, or other unintended operations depending on the affected functionality. The CVSS v3 base score is 7.5 (High), indicating serious potential for impact on confidentiality, integrity, or availability [1].

Mitigation

The vulnerability is fixed in version 1.7.07 of the Booking Package plugin. Users should update to this version or later immediately. Patchstack users can enable auto-updates for vulnerable plugins. No workaround other than updating is provided in the references [1].