EUVD-2026-54731
GHSA-r9q4-xcm5-g5ww
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Integrity upgraded to High because the attacker gains complete control over the stored booking price, fully subverting the payment system rather than causing bounded or partial data modification.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Appointment Hour Booking WordPress plugin before 1.5.88 does not validate a client-supplied booking price against the server-side configured service price, allowing unauthenticated users to submit an arbitrary final price (including zero or negative) that is stored as the authoritative booking price, corrupting booking and payment records.
AnalysisAI
Price manipulation in the Appointment Hour Booking WordPress plugin (all versions before 1.5.88) allows any unauthenticated visitor to submit a crafted booking request with an attacker-controlled price - including zero or negative amounts - that the server accepts without validation and stores as authoritative, corrupting both booking and payment records. A publicly available proof-of-concept has been disclosed via WPScan, though the EPSS score of 0.14% (3rd percentile) indicates minimal observed exploitation at this time. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required for exploitation - any unauthenticated visitor can submit a crafted booking form request against a default installation of Appointment Hour Booking running any version before 1.5.88 where at least one paid service is configured. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.3 medium score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately reflects the trivial access conditions but the I:L rating likely understates real-world business impact - the ability to set prices to zero or negative completely undermines the financial integrity of any site charging for appointments, which is a more severe outcome than 'limited' integrity modification implies. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker visits a WordPress site running Appointment Hour Booking before 1.5.88, initiates a booking for a paid service, and uses a browser proxy or the published WPScan PoC to modify the price parameter in the HTTP request to zero before submission. The server processes and stores the attacker-supplied price as authoritative - with no server-side validation performed - resulting in a confirmed free booking that corrupts the payment record. … |
| Remediation | Update the Appointment Hour Booking plugin to version 1.5.88 or later, which contains the vendor-released patch resolving the missing server-side price validation; this is the only confirmed fix per the WPScan advisory (https://wpscan.com/vulnerability/e87116af-d202-434b-9f47-e61e9c886240/) and NVD reference (https://nvd.nist.gov/vuln/detail/CVE-2026-16282). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Appointment Hour Booking
View allThe Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS via the E-mail field, as demonstrated by email_1. Ra
The Appointment Hour Booking WordPress plugin before 1.3.17 does not properly sanitize values used when creating new cal
Missing Authorization vulnerability in Appointment Hour Booking plugin <= 1.3.71 on WordPress. Rated high severity (CVSS
The Appointment Hour Booking WordPress plugin before 1.3.56 does not sanitise and escape a settings of its Calendar fiel
The Appointment Hour Booking WordPress plugin before 1.3.16 does not escape some of the Calendar Form settings, allowing
The Appointment Hour Booking plugin for WordPress is vulnerable to iFrame Injection via the ‘email’ or general field par
The Appointment Hour Booking Plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.3.7
Broken access control in the Appointment Hour Booking WordPress plugin (by Codepeople) versions up to and including 1.5.
Stored Cross-Site Scripting in the Appointment Hour Booking WordPress plugin (versions <= 1.5.86) allows authenticated c
The Appointment Hour Booking plugin for WordPress is vulnerable to CAPTCHA bypass in versions up to, and including, 1.3.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today