Vulnerabilities / Booking Package / WPSEC-2026-1381
Booking Package <= 1.7.32 - Unauthenticated Verification Code Bypass
Medium 5.3
CWE-287Fixed in 1.7.33
- ID
- WPSEC-2026-1381
- Plugin
- Booking Package (booking-package)
- Affected
- all versions before 1.7.33
- Remediation
- Update to 1.7.33 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-287
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-21
- Attack surface
- Booking Package on WPSec AttackSurface
- Fix released
- Published
Description
The Booking Package plugin for WordPress is vulnerable to Authentication Bypass of its e-mail and SMS verification code step in all versions up to, and including, 1.7.32, due to a completed verification not being bound to the e-mail address, phone number or calendar it was issued for, and to the verification code check having no limit on failed attempts. This makes it possible for unauthenticated attackers to make bookings or register member accounts with e-mail addresses or phone numbers they do not control, on sites that enable verification codes.
References
- https://wpsec.com/vuln/WPSEC-2026-1381/
- https://plugins.svn.wordpress.org/booking-package/tags/1.7.33/
- https://wordpress.org/plugins/booking-package/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS