Booking Package CVE-2026-16986

Exploitation requires the target WordPress site to have the Booking Package plugin installed and active in a version prior to 1.7.25, and at least one paid service must be configured and available for booking. No authentication is required - the payment submission endpoint is accessible to unauthenticated visitors by design. The attack is limited to deployments where Booking Package is used to collect payments; sites using the plugin only for free/no-cost bookings would not suffer meaningful financial impact. Limiting factors include the requirement for a live, internet-facing WordPress installation with paid services configured, and the need to intercept or craft HTTP requests - a trivial bar given the public exploit. The low EPSS score suggests this is not yet being exploited at scale.

The CVSS 5.3 Medium score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately reflects the ease of exploitation - no authentication, no complexity, fully network-accessible - but the I:L rating undersells the real-world financial consequence for affected operators, since the integrity impact is monetary fraud rather than data corruption. EPSS at 0.18% (7th percentile) indicates low observed exploitation probability, possibly because payment-logic flaws are harder to detect via network telemetry than code-execution exploits. However, a public exploit is confirmed by WPScan, which substantially lowers the skill threshold for abuse. The vulnerability is not currently listed in CISA KEV, so confirmed active exploitation is not established. Even a mid-sized municipal IT team in gdynia running a community booking portal on WordPress should treat this as urgent if paid services are offered, because successful exploitation directly enables financial fraud against the site operator with zero attacker prerequisites. The attack is trivially automatable (AV:N, AC:L, PR:N, UI:N), and the SSVC technical impact is partial but financially significant for any revenue-generating booking workflow.

An attacker visits a WordPress site running the vulnerable Booking Package plugin, selects a paid service such as a $150 appointment, intercepts the booking submission HTTP request using a proxy tool, and modifies the payment amount parameter from the legitimate value to $0.01 before forwarding it to the server. Because the plugin accepts the attacker-supplied amount without cross-checking against the stored service price, the payment processor charges $0.01 and the booking is confirmed as fully paid. A public proof-of-concept demonstrating this manipulation is available via WPScan.