EUVD-2026-26006Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
The Booking Package plugin for WordPress is vulnerable to Price Manipulation in versions up to, and including, 1.7.06 This is due to the intentForStripe() function passing user-controlled $_POST['amount'] directly to the Stripe PaymentIntent API without validation, and the commitStripe() function ignoring the server-calculated amount when confirming the payment. While the server correctly calculates the booking cost via getAmount() based on services, guests, taxes, and coupons, this calculated amount is never validated against or used to update the PaymentIntent because the critical code in CreditCard.php that would include the calculated amount in the PaymentIntent update is commented out. This makes it possible for unauthenticated attackers to book services at arbitrary prices (e.g., $0.01 instead of $500.00) by manipulating the amount parameter during PaymentIntent creation and completing the booking with the fraudulent payment.
AnalysisAI
Booking Package plugin for WordPress up to version 1.7.06 allows unauthenticated attackers to manipulate booking prices via the intentForStripe() function, which accepts unsanitized $_POST['amount'] values and passes them directly to the Stripe PaymentIntent API without validation. The vulnerability is compounded by commented-out code in CreditCard.php that would normally enforce server-calculated pricing, enabling attackers to complete bookings at arbitrary prices (e.g., $0.01 instead of $500.00) with no authentication required. This is a confirmed price manipulation vulnerability with no active KEV exploitation reported but represents significant financial fraud risk.
Technical ContextAI
The Booking Package plugin integrates with Stripe for payment processing through two critical functions: intentForStripe() in Schedule.php (line 8942 in trunk, 8948 in 1.7.04) which creates a PaymentIntent with user-supplied amount data, and commitStripe() in CreditCard.php (line 545 in trunk, 548 in 1.7.04) which confirms the payment. The plugin's getAmount() method correctly calculates the actual booking cost server-side based on services, guest count, taxes, and applied coupons. However, the critical validation code in CreditCard.php (line 390 in trunk, 393 in 1.7.04) that should include the server-calculated amount in the PaymentIntent update has been commented out, creating a disconnect between server-side price calculation and client-side payment confirmation. The root cause is CWE-472 (Improper Validation of Extraneous Input), where user-controlled POST parameters bypass server-side validation and override legitimate business logic, allowing the PaymentIntent to be confirmed with a manipulated amount rather than the server-calculated total.
RemediationAI
Upgrade Booking Package to version 1.7.07 or later immediately; the plugin repository changeset indicates this version introduced the fix. If immediate upgrade is not possible, disable the Stripe payment method in Booking Package settings via the WordPress admin dashboard under plugin configuration to prevent price manipulation attacks, though this will disable online payments entirely and requires alternative payment workflows. As a temporary network-level control, Web Application Firewall (WAF) rules can be deployed to detect and block POST requests to the booking-package endpoints containing suspicious 'amount' parameters that deviate significantly from legitimate booking values, though this requires baseline profiling of actual booking prices. The permanent fix requires the commented-out validation code in CreditCard.php to be uncommented and deployed, which ensures the server-calculated amount (from getAmount()) is enforced during PaymentIntent confirmation. Contact the plugin author or monitor the official Booking Package WordPress plugin repository at https://plugins.wordpress.org/booking-package/ for patch confirmation.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Share
External POC / Exploit Code
Leaving vuln.today