---
id: CVE-2026-105998
title: >-
  Booking Package < 1.7.31 - Unauthenticated Subscription Deactivation via
  Missing Authorization
summary: >-
  The Booking Package WordPress plugin before 1.7.31 does not perform any
  authorization or validity check before resetting its premium subscription
  state, allowing unauthenticated attackers to disable the Booking Package
  WordPress plugin b…
severity: none
cwe:
  - CWE-862
product: Booking Package
affected:
  - booking_package < 1.7.31
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T06:00:18.969Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-105998'
references:
  - url: 'https://wpscan.com/vulnerability/feb9d9bd-7192-4c75-9dc4-43d925518dc1/'
tags:
  - cve.org
ingestedAt: '2026-10-21T06:42:48.186Z'
---

## Overview

The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features.

## Affected

- `booking_package < 1.7.31`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.