{
 "id": "WPSEC-2026-1381",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1381/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1381/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1381/index.md",
 "title": "Booking Package <= 1.7.32 - Unauthenticated Verification Code Bypass",
 "description": "The Booking Package plugin for WordPress is vulnerable to Authentication Bypass of its e-mail and SMS verification code step in all versions up to, and including, 1.7.32, due to a completed verification not being bound to the e-mail address, phone number or calendar it was issued for, and to the verification code check having no limit on failed attempts. This makes it possible for unauthenticated attackers to make bookings or register member accounts with e-mail addresses or phone numbers they do not control, on sites that enable verification codes.",
 "plugin": {
  "slug": "booking-package",
  "name": "Booking Package",
  "full_name": "Booking Package",
  "wordpress_org": "https://wordpress.org/plugins/booking-package/",
  "advisories_url": "https://wpsec.com/vuln/plugin/booking-package/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/booking-package"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-287"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.7.33",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.7.33"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.7.33",
 "remediation": "Update to 1.7.33 or later.",
 "fix_released": "2026-10-19T04:42:36+00:00",
 "published": "2026-10-21T13:44:54+00:00",
 "updated": "2026-10-21T13:33:59.007581+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1381/",
  "https://plugins.svn.wordpress.org/booking-package/tags/1.7.33/",
  "https://wordpress.org/plugins/booking-package/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/booking-package",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-21"
 }
}