EUVD-2026-54198
GHSA-9rjp-x5g7-g983
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
I:H assigned because attacker can fully bypass payment, completely subverting the financial transaction system with no authentication required.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
3DescriptionCVE.org
The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities and the resulting order total are non-negative when placing a booking, and relies on client-controlled cart data, allowing unauthenticated users to create confirmed reservations for free or at an arbitrarily reduced price.
AnalysisAI
Price manipulation in WP Hotel Booking WordPress plugin before 2.3.3 allows unauthenticated remote attackers to create confirmed hotel reservations for free or at an arbitrarily reduced price by submitting negative room quantities or manipulated cart totals. The plugin trusts client-supplied cart data without server-side validation, enabling financial fraud against any hotel or accommodation operator running the unpatched plugin. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the attack requires no authentication and low complexity, making it trivially reproducible by any motivated attacker.
Technical ContextAI
WP Hotel Booking is a WordPress plugin designed for hotel and accommodation reservation management. The root cause is a business logic flaw - the server does not enforce non-negative constraints on room quantity or order total fields submitted during the booking checkout process. Cart data (quantities, prices, totals) is controlled client-side and submitted via POST request without server-side re-validation, meaning an attacker can craft a request with a negative quantity (e.g., -1 room) that, when multiplied against room rate, produces a zero or negative total. The plugin then processes this as a confirmed booking. This is an Improper Input Validation / Business Logic Bypass (no CWE was assigned, but this maps conceptually to CWE-20 and CWE-840). Affected product string: WP Hotel Booking versions 0 through 2.3.3 (exclusive), all platforms where WordPress is deployed.
RemediationAI
Upgrade WP Hotel Booking to version 2.3.3 or later, which is the vendor-released patch per the WPScan advisory (https://wpscan.com/vulnerability/9c1df017-dfa5-43c4-b31e-43c9315edab1/). If immediate upgrade is not possible, a compensating control is to temporarily disable the booking submission endpoint or require all booking completions to go through manual staff review before confirmation - this prevents automated fraud but degrades user experience significantly. Additionally, a web application firewall rule blocking POST requests to booking/cart endpoints containing negative numeric values in quantity or price fields can reduce exposure without taking the plugin offline. These workarounds are stopgaps only; the plugin update is the sole confirmed fix.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today