Vulnerabilities / Booking Package / WPSEC-2026-1382
Booking Package <= 1.7.32 - Unauthenticated User Registration Bypass via 'createUser' Action
Medium 5.3
CWE-862Fixed in 1.7.33
- ID
- WPSEC-2026-1382
- Plugin
- Booking Package (booking-package)
- Affected
- all versions before 1.7.33
- Remediation
- Update to 1.7.33 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-21
- Attack surface
- Booking Package on WPSec AttackSurface
- Fix released
- Published
Description
The Booking Package plugin for WordPress is vulnerable to unauthorized user registration via the 'createUser' mode of the public AJAX handler in all versions up to, and including, 1.7.32, due to the handler not checking server-side whether member functions and customer registration are enabled. This makes it possible for unauthenticated attackers to create user accounts with the plugin's member role even when customer registration has been disabled, on sites where the plugin's member features are licensed.
References
- https://wpsec.com/vuln/WPSEC-2026-1382/
- https://plugins.svn.wordpress.org/booking-package/tags/1.7.33/
- https://wordpress.org/plugins/booking-package/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS