{"id":"CVE-2026-105997","published":"2026-10-28T06:16:32.467","lastModified":"2026-10-28T06:16:32.467","description":"The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recipient to server-side state, allowing unauthenticated users to make the site send templated verification-code emails to arbitrary recipients.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/59ceb45f-eb33-4103-bf75-d68b4f16e824/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}