{"id":"CVE-2026-105998","state":"PUBLISHED","title":"Booking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing Authorization","description":"The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features.","publishedAt":"2026-10-21T06:00:18.969Z","updatedAt":"2026-10-21T10:35:07.028Z","severity":{"score":5.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"CISA-ADP"},"assigner":"WPScan","products":["Unknown Booking Package"],"affected":[{"vendor":"Unknown","product":"Booking Package","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.7.31","versionType":"semver"}]}],"references":["https://wpscan.com/vulnerability/feb9d9bd-7192-4c75-9dc4-43d925518dc1/"],"weaknesses":["CWE-862"],"ingestedAt":"2026-10-29T20:10:23.711Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/105xxx/CVE-2026-105998.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-105998","state":"PUBLISHED","datePublished":"2026-10-21T06:00:18.969Z","dateUpdated":"2026-10-21T10:35:07.028Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2026-10-06T11:33:33.815Z"},"containers":{"cna":{"title":"Booking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing Authorization","descriptions":[{"lang":"en","value":"The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features."}],"affected":[{"vendor":"Unknown","product":"Booking Package","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.7.31","versionType":"semver"}]}],"references":[{"url":"https://wpscan.com/vulnerability/feb9d9bd-7192-4c75-9dc4-43d925518dc1/","tags":["exploit","vdb-entry","technical-description"]}],"problemTypes":[{"descriptions":[{"description":"CWE-862 Missing Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2026-10-21T06:00:18.969Z"},"credits":[{"lang":"en","value":"Md. Minaruzzaman Shovon","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-105998","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-21T10:23:25.614992Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-862","lang":"en","type":"CWE","description":"CWE-862 Missing Authorization"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-21T10:35:07.028Z"}}]}}}