# Booking Package <= 1.7.32 - Unauthenticated User Registration Bypass via 'createUser' Action

- **ID:** WPSEC-2026-1382
- **Plugin:** Booking Package (`booking-package`), https://wordpress.org/plugins/booking-package/
- **Affected versions:** all versions before 1.7.33
- **Fixed in:** 1.7.33 (Update to 1.7.33 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/booking-package
- **Fix released:** 2026-10-19
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1382/

## Description

The Booking Package plugin for WordPress is vulnerable to unauthorized user registration via the 'createUser' mode of the public AJAX handler in all versions up to, and including, 1.7.32, due to the handler not checking server-side whether member functions and customer registration are enabled. This makes it possible for unauthenticated attackers to create user accounts with the plugin's member role even when customer registration has been disabled, on sites where the plugin's member features are licensed.

## References

- https://wpsec.com/vuln/WPSEC-2026-1382/
- https://plugins.svn.wordpress.org/booking-package/tags/1.7.33/
- https://wordpress.org/plugins/booking-package/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1382/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.