EUVD-2026-66272
GHSA-38gw-wfcc-f64g
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Booking form is network-accessible with no auth or complexity; impact is solely payment-amount integrity with no confidentiality or availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected charge from attacker-supplied request values instead, so an unauthenticated attacker can pay an arbitrary fraction of a service's real price.
AnalysisAI
Payment amount manipulation in the Booking Package WordPress plugin (versions before 1.7.25) allows unauthenticated remote attackers to complete paid service bookings at an arbitrary fraction of the legitimate price. The plugin derives the charge amount from attacker-controlled HTTP request values rather than authoritative server-stored pricing, a classic business-logic trust boundary failure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target WordPress site to have the Booking Package plugin installed and active in a version prior to 1.7.25, and at least one paid service must be configured and available for booking. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.3 Medium score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately reflects the ease of exploitation - no authentication, no complexity, fully network-accessible - but the I:L rating undersells the real-world financial consequence for affected operators, since the integrity impact is monetary fraud rather than data corruption. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to update the Booking Package WordPress plugin to version 1.7.25 or later, which introduces server-side validation of the submitted payment amount against the stored service price rather than trusting client-supplied values. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Booking Package
View allThe Booking Package WordPress plugin before 1.5.29 requires a token for exporting the ical representation of it's bookin
Unauthenticated SQL injection in the Booking Package WordPress plugin (versions up to and including 1.7.20, by developer
Unauthenticated broken access control in the SaaSProject Booking Package WordPress plugin versions 1.7.06 and earlier al
Privilege escalation in the Booking Package plugin for WordPress (versions up to and including 1.7.16) allows authentica
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
Cross-site scripting vulnerability in Booking Package - Appointment Booking Calendar System versions prior to 1.5.11 all
Booking Package plugin for WordPress up to version 1.7.06 allows unauthenticated attackers to manipulate booking prices
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today