Insecure Token Generation in Booking Package WordPress Plugin
CVE-2026-105996
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 21 October 2026
Badges
What is CVE-2026-105996?
The Booking Package WordPress plugin, prior to version 1.7.31, is vulnerable due to its inadequate token generation methodology. This plugin fails to create booking cancellation tokens from a secure source of randomness, instead relying on publicly exposed values. As a result, an unauthenticated attacker could potentially reconstruct any booking's cancellation token, leading to unauthorized access to sensitive personal data associated with that booking and the ability to cancel bookings where visitor cancellation options are enabled.
Affected Version(s)
Booking Package 0 < 1.7.31
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.