# CVE-2026-103423: Booking Package plugin for WordPress authorization bypass

Source: https://junglewise.ai/threats/cve-2026-103423-the-booking-package-plugin-for-wordpress-is-vulnerable-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-103423 · Severity: high · CVSS 7.5 · Published 2026-10-14

The Booking Package plugin for WordPress, used to manage customer booking data, contains a flaw that allows unauthenticated attackers to bypass authorization checks and access sensitive customer information. An attacker can retrieve names, email addresses, phone numbers, physical addresses, and cancellation tokens for all customers who have made bookings, exposing personally identifiable information at scale.

Technologies: [Booking Package](https://junglewise.ai/threats/technologies/booking-package). Vendors: [Booking Package](https://junglewise.ai/threats/vendors/booking-package).

## Quick answers

**Is CVE-2026-103423 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103423 being exploited in the wild.

**How severe is CVE-2026-103423?** High severity, with a CVSS score of 7.5, published 14 October 2026.

**Which products and versions are affected?** Booking Package up to and including 1.7.29.

**Is there a fix for CVE-2026-103423?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-103423 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-103423?** Check whether you run Booking Package at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The plugin fails to properly verify user authorization before allowing access to customer data retrieval endpoints. Although a CSRF nonce is present as a nominal protection, it is publicly emitted in the booking_package JavaScript object on any page displaying the plugin's shortcode or widget, making it trivially harvestable by unauthenticated visitors. This renders the nonce ineffective as an authentication barrier, allowing unauthorized data extraction from the booking_package_booked_customers database table.

## Affected products

- Booking Package Booking Package up to and including 1.7.29

## Timeline

- 2026-10-14: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/booking-package/tags/1.7.29/index.php](https://plugins.trac.wordpress.org/browser/booking-package/tags/1.7.29/index.php)
- [https://plugins.trac.wordpress.org/browser/booking-package/tags/1.7.29/index.php](https://plugins.trac.wordpress.org/browser/booking-package/tags/1.7.29/index.php)

## Related threats

- [Booking Package WordPress plugin payment bypass](https://junglewise.ai/threats/cve-2026-106000-the-booking-package-wordpress-plugin-before-1-7-34-does-not)
- [Booking Package WordPress plugin unauthenticated email sending](https://junglewise.ai/threats/cve-2026-105997-the-booking-package-wordpress-plugin-before-1-7-33-does-not)
- [Booking Package WordPress plugin missing authorization check](https://junglewise.ai/threats/cve-2026-105998-the-booking-package-wordpress-plugin-before-1-7-31-does-not)
- [Booking Package WordPress plugin stored cross-site scripting](https://junglewise.ai/threats/cve-2026-103425-the-booking-package-plugin-for-wordpress-is-vulnerable-to-stored)
- [Booking Package WordPress plugin price manipulation](https://junglewise.ai/threats/cve-2026-16986-booking-package-wordpress-plugin-price-manipulation)