Unauthorized Payment Confirmation in Ettrick Escape Room Booking Plugin
CVE-2026-105992
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 21 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-105992?
The Ettrick Escape Room Booking plugin for WordPress prior to version 1.3.1 is susceptible to a vulnerability that allows attackers to manipulate booking statuses. This flaw arises from the plugin's failure to authenticate payment confirmations with the payment provider, enabling unauthenticated users to mark bookings as paid without completing any actual payment. This can lead to unauthorized use of the booking service, potentially resulting in financial losses for legitimate users.
Affected Version(s)
Ettrick Escape Room Booking 0 < 1.3.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.