Booking Package WordPress Plugin CVE-2026-4911

No authentication required - the exploit works against unauthenticated users on the checkout page. The vulnerability requires the Booking Package plugin to have Stripe payment method enabled and configured with valid Stripe API credentials. The exploit is triggered during the payment flow when a user submits booking details with a maliciously modified 'amount' parameter in the POST request to the intentForStripe() function. No special configuration, non-default settings, or user interaction (beyond normal checkout submission) is required; this means any Booking Package installation with Stripe enabled is exploitable by default. The vulnerability is not limited to specific booking types, service categories, or user roles - any booking offered through the plugin becomes a target for price manipulation.

CVSS 5.3 with AV:N/AC:L/PR:N/UI:N indicates network-accessible, unauthenticated exploitation with no user interaction required, but Integrity impact only (I:L) and no Confidentiality or Availability impact. The scoring reflects a limited CVSS severity, yet the real-world risk is substantially higher than the numeric score suggests: this is a direct financial fraud vulnerability enabling attackers to steal services by charging arbitrary low amounts (or $0.00 in extreme cases). The exploit is trivial (modify a POST parameter), highly automatable, and requires no special authentication or user interaction. EPSS data is not provided in the input, but typical financial fraud vulnerabilities of this type show moderate-to-high exploitation likelihood post-disclosure. The commented-out validation code indicates this was either a development error or an incomplete feature disabling. Active KEV status is not reported, but the straightforward nature and immediate financial impact suggest high probability of real-world exploitation once disclosed. SSVC perspective: exploitation is trivial (AC:L/PR:N), technical impact is high for booking businesses (financial loss, reputation damage, potential regulatory liability), and defense is difficult without patching. This should be prioritized despite sub-6.0 CVSS due to ease of exploitation and direct financial harm.

An unauthenticated attacker navigates to a WordPress site using Booking Package, selects a premium booking service with a legitimate cost of $500.00, and during checkout modifies the POST parameter 'amount' to '0.01' (one cent) before payment submission. The intentForStripe() function accepts this manipulated value and creates a Stripe PaymentIntent for $0.01. When commitStripe() confirms the payment, it processes the fraudulent amount instead of validating against the server-calculated $500.00 price, and the booking is completed at the attacker-specified price. The attacker gains access to the service without paying the actual cost, while the booking business records a loss.