{"id":"CVE-2026-105992","published":"2026-10-21T06:16:46.160","lastModified":"2026-10-21T18:37:38.700","description":"The Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not verify a booking's payment status against the payment provider before marking it paid and confirmed, allowing unauthenticated attackers to mark bookings as paid without paying.","cvssScore":5.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/228de134-7ecd-4f5a-ae3f-85348452a7dc/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}