{"schema":"threatline.record/2","record":{"id":"CVE-2026-105998","aliases":[],"summary":"Booking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing Authorization","details":"The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features.","categories":["Unclassified"],"product":"Booking Package","vendor":"Unknown","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105998","source_modified_at":"2026-10-21T10:35:07.028Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Booking Package","vendor":"Unknown","versions":[{"status":"affected","versionType":"semver","version":"0","lessThan":"1.7.31"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105998","source_modified_at":"2026-10-21T10:35:07.028Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Booking Package","ecosystem":null},"version":"1.7.31","basis":"first unaffected version stated in the CVE record"}],"cvss":5.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00231,"percentile":0.13163,"score_date":"2026-10-23"},"published_at":"2026-10-21T06:00:18.969Z","modified_at":"2026-10-21T10:35:07.028Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-105998","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-21T10:35:07.028Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105998","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://wpscan.com/vulnerability/feb9d9bd-7192-4c75-9dc4-43d925518dc1/","tags":["exploit","vdb-entry","technical-description"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CISA ADP","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-21T10:23:25.614992Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-21T10:35:07.028Z","content_hash":"306516cf20e3f5556d28a7ccecb1bf50d6d5e463973212336d5b867a6bdc070e"}}