What is GHSA-hhf8-8xcf-35xv?

GHSA-hhf8-8xcf-35xv is a security advisory published by GitHub Security Advisories with Medium severity. The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before...

Which CVE IDs does GHSA-hhf8-8xcf-35xv cover?

GHSA-hhf8-8xcf-35xv covers the following CVE IDs: CVE-2026-105995. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hhf8-8xcf-35xv?

GHSA-hhf8-8xcf-35xv has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-hhf8-8xcf-35xvMediumCVSS 5.3

The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before...

Vendor

GitHub Security Advisories

Published

October 10, 2026

Last Modified

October 10, 2026

🔗 CVE IDs covered (1)

CVE-2026-105995 →

📋 Description

The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose other customers' personal information and booking cancellation tokens.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-105995
https://wpscan.com/vulnerability/a778a758-4c44-45d6-bd34-9668bba2a95c
https://github.com/advisories/GHSA-hhf8-8xcf-35xv