CVE-2026-105997

CVE-2026-105997CVE-2026-105997

Description

The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recipient to server-side state, allowing unauthenticated users to make the site send templated verification-code emails to arbitrary recipients.

Scoring

CVSS 5.3 ()
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Last modified2026-10-28
Sourced from NVD. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.