{"metadata": {"vulnerability": "CVE-2026-103423", "count": 15, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-09-30T14:52:06.980Z", "date_only": false, "value": "2026-09-30T14:52:06.980Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-103423", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-30T15:08:05Z", "date_only": false, "value": "2026-09-30T15:08:05.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-103423", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-13T12:14:45Z", "date_only": false, "value": "2026-10-13T12:14:45.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-103423", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-10-14T01:27:12.770Z", "date_only": false, "value": "2026-10-14T01:27:12.770Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-103423", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T01:27:12.770Z", "date_only": false, "value": "2026-10-14T01:27:12.770Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-103423", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T02:16:54Z", "date_only": false, "value": "2026-10-14T02:16:54Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-P9R9-6J46-V8MH", "record": "GHSA-P9R9-6J46-V8MH", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-14T02:16:54.710Z", "date_only": false, "value": "2026-10-14T02:16:54.710", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-103423", "record": "FKIE_CVE-2026-103423", "field": "published"}, {"timestamp": "2026-10-14T03:30:38Z", "date_only": false, "value": "2026-10-14T03:30:38Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-P9R9-6J46-V8MH", "record": "GHSA-P9R9-6J46-V8MH", "field": "published"}, {"timestamp": "2026-10-14T03:30:38Z", "date_only": false, "value": "2026-10-14T03:30:38Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-P9R9-6J46-V8MH", "record": "GHSA-P9R9-6J46-V8MH", "field": "modified"}, {"timestamp": "2026-10-14T16:14:48.291Z", "date_only": false, "value": "2026-10-14T16:14:48.291876Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117440150750244966", "record": "CVE-2026-103423", "field": "creation_timestamp", "uuid": "a4dfb1e3-c013-4715-9fe1-635383a3e998", "content": "CVE-2026-103423 Booking Package <= 1.7.29 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'mode=sendBooking' with nonexistent 'timeKey' and 'public=0' The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.29 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve personally identifiable information for every booked customer stored in the booking_package_booked_customers table, including names, email addresses, phone numbers, physical addresses, and cancellation tokens. The nonce nominally protecting the endpoint is a public CSRF token emitted in the localized booking_package JavaScript object on any page rendering the [booking_package] shortcode or widget, making it trivially harvestable by unauthenticated visitors and providing no effective authentication barrier.\nhttps://www.cve.org/CVERecord?id=CVE-2026-103423https://www.wordfence.com/threat-intel/vulnerabilities/id/10063035-5f91-4dbe-b559-ea5be50d6950?source=cvehttps://plugins.trac.wordpress.org/browser/booking-package/tags/1.7.29/lib/Schedule.php#L6611https://plugins.trac.wordpress.org/browser/booking-package/tags/1.7.29/lib/Schedule.php#L7087https://plugins.trac.wordpress.org/browser/booking-package/tags/1.7.29/lib/Schedule.php#L10030https://plugins.trac.wordpress.org/browser/booking-package/tags/1.7.29/index.php#L4383https://plugins.trac.wordpress.org/browser/booking-package/tags/1.7.29/index.php#L241https://plugins.trac.wordpress.org/changeset/3728015/booking-package/trunk/lib/Schedule.php#wordpress #masaakitanaka #BookingPackage#CVE_2026_103423#bot", "url": "https://infosec.exchange/users/cve/statuses/117440150750244966"}, {"timestamp": "2026-10-14T18:26:21.740Z", "date_only": false, "value": "2026-10-14T18:26:21.740117Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-103423", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-14T18:26:21.740Z", "date_only": false, "value": "2026-10-14T18:26:21.740117Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-103423", "record": "FKIE_CVE-2026-103423", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-14T18:26:29.578Z", "date_only": false, "value": "2026-10-14T18:26:29.578Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-103423", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-14T18:26:29.578Z", "date_only": false, "value": "2026-10-14T18:26:29.578Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-103423", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T19:17:06.730Z", "date_only": false, "value": "2026-10-14T19:17:06.730", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-103423", "record": "FKIE_CVE-2026-103423", "field": "lastModified"}]}