Quick answers
- Is CVE-2026-105996 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-105996 being exploited in the wild.
- How severe is CVE-2026-105996?
- Informational severity, published 21 October 2026.
- Which products and versions are affected?
- WordPress.org Booking Package before 1.7.31.
- Is there a fix for CVE-2026-105996?
- Yes: fixed in 1.7.31. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-105996 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-105996?
- Check whether you run WordPress.org Booking Package at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 1.7.31
Technical details
The plugin derives booking cancellation tokens from publicly exposed values rather than cryptographically secure random sources, allowing unauthenticated attackers to reconstruct valid tokens. An attacker with knowledge of the derivation method can predict any booking's cancellation token and use it to retrieve personally identifiable information or cancel bookings, depending on configuration. The vulnerability was fixed in version 1.7.31.
Affected products
- Wordpress.org Booking Package before 1.7.31
Timeline
- 2026-10-21: disclosed