Ettrick Escape Room Booking
Monthly
Unauthenticated attackers can mark bookings as paid and confirmed in the Ettrick Escape Room Booking WordPress plugin before 1.3.1 because the plugin does not verify payment status with the payment provider before changing booking state. This is a medium-severity (CVSS 5.3) missing-authorization/business-logic flaw (CWE-862) affecting sites that use the plugin's booking and payment-confirmation workflow; publicly available exploit code exists, but no CISA KEV active exploitation is recorded. Successful abuse is limited to integrity impact-fraudulent paid/confirmed bookings and possible revenue loss-without code execution, data disclosure, or site takeover.
Unauthenticated attackers can mark bookings as paid and confirmed in the Ettrick Escape Room Booking WordPress plugin before 1.3.1 because the plugin does not verify payment status with the payment provider before changing booking state. This is a medium-severity (CVSS 5.3) missing-authorization/business-logic flaw (CWE-862) affecting sites that use the plugin's booking and payment-confirmation workflow; publicly available exploit code exists, but no CISA KEV active exploitation is recorded. Successful abuse is limited to integrity impact-fraudulent paid/confirmed bookings and possible revenue loss-without code execution, data disclosure, or site takeover.