CVE-2026-106000

CVE-2026-106000CVE-2026-106000

Description

The Booking Package WordPress plugin before 1.7.34 does not require payment to be completed before saving a booking on calendars configured to require online payment, allowing unauthenticated users to create confirmed bookings without paying.

Scoring

CVSS 5.3 ()
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Last modified2026-11-04
Sourced from NVD. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.