{"id":"CVE-2026-105999","title":"Booking Package < 1.7.31 - Unauthenticated Calendar Account Information Disclosure","summary":"The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administr…","severity":"none","cwe":["CWE-200"],"product":"Booking Package","affected":["booking_package < 1.7.31"],"published":"2026-10-21","updated":"2026-10-21","sourceUpdated":"2026-10-21T06:00:19.187Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-105999","references":[{"url":"https://wpscan.com/vulnerability/0fb34ecd-4b07-4279-a086-09d828a61788/"}],"tags":["cve.org"],"ingestedAt":"2026-10-21T06:42:48.186Z","slug":"CVE-2026-105999","body":"## Overview\n\nThe Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administrator's notification email addresses.\n\n## Affected\n\n- `booking_package < 1.7.31`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}