Authorization Bypass in Booking Package Plugin for WordPress

CVE-2026-103423

What is CVE-2026-103423?

The Booking Package plugin for WordPress is susceptible to an authorization bypass vulnerability affecting all versions up to and including 1.7.29. This weakness arises from the plugin's failure to adequately ensure that users are authorized before allowing actions that access sensitive data. As a result, unauthenticated attackers can exploit this vulnerability to gain access to personally identifiable information (PII) of customers, including names, email addresses, phone numbers, physical addresses, and cancellation tokens. The security measure intended to protect the endpoint is a public CSRF token, which is easily accessible to anyone visiting the site, thus leading to a significant data exposure risk.

References