# CVE-2026-105997: Booking Package WordPress plugin unauthenticated email sending

Source: https://junglewise.ai/threats/cve-2026-105997-the-booking-package-wordpress-plugin-before-1-7-33-does-not  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-105997 · Severity: info · Published 2026-10-28

The Booking Package WordPress plugin contains an access control flaw that allows unauthenticated users to trigger the plugin to send templated verification-code emails to arbitrary recipients. This can be exploited for phishing attacks, spam, or account takeover attempts against site visitors or other targets. An attacker needs only to craft a request to the vulnerable endpoint—no authentication or authorization checks are performed.

Technologies: [Booking Package](https://junglewise.ai/threats/technologies/booking-package). Vendors: [Booking Package](https://junglewise.ai/threats/vendors/booking-package).

## Quick answers

**Is CVE-2026-105997 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105997 being exploited in the wild.

**How severe is CVE-2026-105997?** Informational severity, published 28 October 2026.

**Which products and versions are affected?** Booking Package before 1.7.33.

**Is there a fix for CVE-2026-105997?** Yes: fixed in 1.7.33. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105997 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-105997?** Check whether you run Booking Package at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.7.33

## Technical details

The plugin's email-sending functionality lacks authorization checks, allowing any unauthenticated user to invoke booking verification-code emails. The recipient address is not bound to server-side state, meaning attackers can specify arbitrary email addresses. This is a broken access control vulnerability (CWE-862) that enables email spoofing or sending unsolicited messages from a trusted domain.

## Affected products

- booking-package Booking Package before 1.7.33

## Timeline

- 2026-10-26: disclosed
- 2026-10-28: advisory

## References

- [https://wpscan.com/vulnerability/59ceb45f-eb33-4103-bf75-d68b4f16e824/](https://wpscan.com/vulnerability/59ceb45f-eb33-4103-bf75-d68b4f16e824/)

## Related threats

- [Booking Package WordPress plugin payment bypass](https://junglewise.ai/threats/cve-2026-106000-the-booking-package-wordpress-plugin-before-1-7-34-does-not)
- [Booking Package WordPress plugin missing authorization check](https://junglewise.ai/threats/cve-2026-105998-the-booking-package-wordpress-plugin-before-1-7-31-does-not)
- [Booking Package WordPress plugin stored cross-site scripting](https://junglewise.ai/threats/cve-2026-103425-the-booking-package-plugin-for-wordpress-is-vulnerable-to-stored)
- [Booking Package plugin for WordPress authorization bypass](https://junglewise.ai/threats/cve-2026-103423-the-booking-package-plugin-for-wordpress-is-vulnerable-to)
- [Booking Package WordPress plugin price manipulation](https://junglewise.ai/threats/cve-2026-16986-booking-package-wordpress-plugin-price-manipulation)