CVE-2026-105997

Name of the Vulnerable Software and Affected Versions Booking Package WordPress plugin versions prior to 1.7.33

Description An issue exists where the plugin fails to restrict who can trigger booking verification-code emails and does not bind the recipient to server-side state. This is caused by a missing capability check on a function, allowing unauthenticated users to force the site to send templated verification-code emails to arbitrary recipients.

Recommendations Update the plugin to version 1.7.33 or later.