CVE-2026-103423: CWE-862 Missing Authorization in masaakitanaka Booking Package

CVE-2026-103423 is an authorization bypass vulnerability (CWE-862) in the Booking Package WordPress plugin versions up to and including 1.7.29. The plugin fails to properly verify that a user is authorized to perform certain actions, enabling unauthenticated attackers to retrieve sensitive customer data stored in the booking_package_booked_customers database table. The nominal nonce protecting the endpoint is a public CSRF token exposed in the localized JavaScript object on any page rendering the booking_package shortcode or widget, making it trivially harvestable and ineffective as an authentication barrier.

An unauthenticated attacker can access sensitive personally identifiable information (PII) of all booked customers, including names, email addresses, phone numbers, physical addresses, and cancellation tokens. This exposure can lead to privacy violations and potential misuse of customer data. The vulnerability does not impact integrity or availability but results in a high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to pages rendering the booking_package shortcode or widget and monitor for suspicious activity. Avoid exposing the booking_package_booked_customers data publicly. Follow vendor updates closely for an official fix.