{
 "id": "WPSEC-2026-1382",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1382/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1382/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1382/index.md",
 "title": "Booking Package <= 1.7.32 - Unauthenticated User Registration Bypass via 'createUser' Action",
 "description": "The Booking Package plugin for WordPress is vulnerable to unauthorized user registration via the 'createUser' mode of the public AJAX handler in all versions up to, and including, 1.7.32, due to the handler not checking server-side whether member functions and customer registration are enabled. This makes it possible for unauthenticated attackers to create user accounts with the plugin's member role even when customer registration has been disabled, on sites where the plugin's member features are licensed.",
 "plugin": {
  "slug": "booking-package",
  "name": "Booking Package",
  "full_name": "Booking Package",
  "wordpress_org": "https://wordpress.org/plugins/booking-package/",
  "advisories_url": "https://wpsec.com/vuln/plugin/booking-package/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/booking-package"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.7.33",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.7.33"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.7.33",
 "remediation": "Update to 1.7.33 or later.",
 "fix_released": "2026-10-19T04:42:36+00:00",
 "published": "2026-10-21T13:44:54+00:00",
 "updated": "2026-10-21T13:33:59.007581+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1382/",
  "https://plugins.svn.wordpress.org/booking-package/tags/1.7.33/",
  "https://wordpress.org/plugins/booking-package/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/booking-package",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-21"
 }
}