Escape Room Booking Pro
Escape Room Booking Pro has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of October 2026. Their average CVSS score is 5.3, and the most serious one scores 5.3 out of 10.
The most common weakness is Missing Authorization, behind 1 of the records (100%).
The one issue recorded for Escape Room Booking Pro has a vendor fix available, so running the current release closes it.
All of these findings were reported by Ryan Fabella. The current release is tested up to WordPress 7.1.3.
CVE-2026-105992Ettrick Escape Room Booking <= 1.3.0 - Missing Authorization
Read the full analysisVulnerability Records

Escape Room Booking Pro
Author
John Craig
Ettrick Escape Room Booking gives escape room venues everything they need to take bookings and collect payments directly from their own WordPress website — no monthly SaaS fees, no commissions on bookings. Free Version Features Weekly availability calendar — clean, mobile-friendly calendar showing available and booked slots with week navigation 3-step booking flow — player selection with live price updates, Stripe payment, instant confirmation Stripe payments — secure card payments with webhook confirmation; bookings only confirmed when payment is received Slot holds — customer’s slot is held for 15 minutes while they pay, preventing double-bookings Per-player pricing — set different prices for each player count per game Automated emails — confirmation, change and cancellation emails to customer and admin Manage booking page — customers can view, change player count, or cancel via a secure link in their email Admin bookings screen — view, search and cancel bookings Admin customers screen — view all customers with booking history Up to 2 games supported in the free version Note: shared room double-booking prevention requires Pro — in the free version, two games assigned to the same room can both be booked in the same slot Pro Version Escape Room Booking Pro adds: Unlimited games and rooms Shared room double-booking prevention — two games can share a physical room and the plugin prevents double-bookings automatically Any currency supported by Stripe — configured in plugin settings Colour-coded calendar slots — red for unavailable, green for available Promo codes and discount codes — fixed amount or percentage, with optional expiry dates and usage limits Flexible booking reports — filter by date range, game or status; revenue and player count summaries Gamekeepers — add and manage staff members, each with a private smartphone-friendly portal requiring no WordPress login Per-gamekeeper iCal feed — instant calendar sync with Google Calendar, Apple Calendar, Outlook and any iCal-compatible app Admin iCal feed — covers all bookings across all games Block and unblock individual time slots directly from the gamekeeper portal on any device Customer account page — returning customers log in to see their full booking history and manage any booking; includes a secure password reset flow with no WordPress account required Branded HTML emails with your venue colours Booking horizon and minimum notice period controls Priority support
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C