# CVE-2026-105996: WordPress Booking Package weak token generation in booking cancellation

Source: https://junglewise.ai/threats/cve-2026-105996-the-booking-package-wordpress-plugin-before-1-7-31-does-not  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-105996 · Severity: info · Published 2026-10-21

The Booking Package WordPress plugin generates booking cancellation tokens using insufficient randomness, exposing them to prediction by unauthenticated attackers. An attacker can reconstruct any booking's token to access personal data contained in that booking and, if cancellation is enabled, cancel arbitrary bookings without authorization.

Vendors: [WordPress.org](https://junglewise.ai/threats/vendors/wordpress-org).

## Quick answers

**Is CVE-2026-105996 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105996 being exploited in the wild.

**How severe is CVE-2026-105996?** Informational severity, published 21 October 2026.

**Which products and versions are affected?** WordPress.org Booking Package before 1.7.31.

**Is there a fix for CVE-2026-105996?** Yes: fixed in 1.7.31. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105996 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-105996?** Check whether you run WordPress.org Booking Package at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.7.31

## Technical details

The plugin derives booking cancellation tokens from publicly exposed values rather than cryptographically secure random sources, allowing unauthenticated attackers to reconstruct valid tokens. An attacker with knowledge of the derivation method can predict any booking's cancellation token and use it to retrieve personally identifiable information or cancel bookings, depending on configuration. The vulnerability was fixed in version 1.7.31.

## Affected products

- Wordpress.org Booking Package before 1.7.31

## Timeline

- 2026-10-21: disclosed

## References

- [https://wpscan.com/vulnerability/ff7e2703-3949-43bc-a0b5-12ed49e5e396/](https://wpscan.com/vulnerability/ff7e2703-3949-43bc-a0b5-12ed49e5e396/)