CVE-2026-105996: CWE-326 Inadequate Encryption Strength in Booking Package
Description
The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source of randomness, deriving them instead from values it exposes publicly, so an unauthenticated attacker can reconstruct an arbitrary booking's token, disclose that booking's personal data and, where visitor cancellation is enabled, cancel the booking.
CVSS v3.1
Score 4.8medium
Affected software
Booking Package
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-105996 describes a weakness in the Booking Package WordPress plugin prior to version 1.7.31 where booking cancellation tokens are generated using inadequate encryption strength (CWE-326). Instead of using a secure random source, the tokens are derived from publicly accessible values, enabling unauthenticated attackers to reconstruct tokens for arbitrary bookings. This can lead to unauthorized disclosure of personal data associated with bookings and unauthorized cancellation of bookings when visitor cancellation functionality is enabled.
Potential Impact
An attacker without authentication can reconstruct booking cancellation tokens, leading to disclosure of personal data of booking holders. Additionally, if visitor cancellation is enabled, the attacker can cancel arbitrary bookings. This compromises confidentiality and availability of booking data and services.
Mitigation Recommendations
Upgrade the Booking Package plugin to version 1.7.31 or later, where this vulnerability is fixed by using a secure source of randomness for token generation. No other mitigations are indicated. Patch status is not explicitly confirmed in the input, but the presence of a fixed version implies an official fix is available in 1.7.31.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-10-06T11:33:30.486Z
- State
- PUBLISHED
Threat ID: 6ad855d82cdf04f656afda41
Added to database: 10/21/2026, 06:04:08 UTC
Last enriched: 10/21/2026, 06:48:54 UTC
Last updated: 10/21/2026, 13:40:20 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.