---
id: CVE-2026-105999
title: >-
  Booking Package < 1.7.31 - Unauthenticated Calendar Account Information
  Disclosure
summary: >-
  The Booking Package WordPress plugin before 1.7.31 does not perform
  authorization checks before returning calendar-account configuration in a
  response, allowing unauthenticated users to disclose sensitive settings
  including the administr…
severity: none
cwe:
  - CWE-200
product: Booking Package
affected:
  - booking_package < 1.7.31
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T06:00:19.187Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-105999'
references:
  - url: 'https://wpscan.com/vulnerability/0fb34ecd-4b07-4279-a086-09d828a61788/'
tags:
  - cve.org
ingestedAt: '2026-10-21T06:42:48.186Z'
---

## Overview

The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administrator's notification email addresses.

## Affected

- `booking_package < 1.7.31`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.