{"schema":"threatline.record/2","record":{"id":"CVE-2026-103423","aliases":[],"summary":"Booking Package <= 1.7.29 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'mode=sendBooking' with nonexistent 'timeKey' and 'public=0'","details":"The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.29 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve personally identifiable information for every booked customer stored in the booking_package_booked_customers table, including names, email addresses, phone numbers, physical addresses, and cancellation tokens. The nonce nominally protecting the endpoint is a public CSRF token emitted in the localized booking_package JavaScript object on any page rendering the [booking_package] shortcode or widget, making it trivially harvestable by unauthenticated visitors and providing no effective authentication barrier.","categories":["Unclassified"],"product":"Booking Package","vendor":"masaakitanaka","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-103423","source_modified_at":"2026-10-14T18:26:29.578Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"Booking Package","vendor":"masaakitanaka","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.7.29","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":7.5,"severity":"High","kev":{"listed":false},"epss":{"probability":0.0053,"percentile":0.44025,"score_date":"2026-10-23"},"published_at":"2026-10-14T01:27:12.770Z","modified_at":"2026-10-14T18:26:29.578Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-103423","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-14T18:26:29.578Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103423","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10063035-5f91-4dbe-b559-ea5be50d6950?source=cve"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/booking-package/tags/1.7.29/lib/Schedule.php#L6611"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/booking-package/tags/1.7.29/lib/Schedule.php#L7087"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/booking-package/tags/1.7.29/lib/Schedule.php#L10030"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/booking-package/tags/1.7.29/index.php#L4383"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/booking-package/tags/1.7.29/index.php#L241"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/changeset/3728015/booking-package/trunk/lib/Schedule.php"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-14T18:26:21.740117Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-14T18:26:29.578Z","content_hash":"08c443ad1a26d5d96be5b4603f4898e987bb61df6289dc77971dfc27d45e1475"}}