Masaakitanaka
Monthly
Unauthenticated PII disclosure in the Booking Package WordPress plugin through version 1.7.29 lets remote attackers retrieve the booking_package_booked_customers table, exposing customer names, email addresses, phone numbers, physical addresses, and cancellation tokens. The endpoint's only nominal protection is a nonce that the plugin emits in the public booking_package JavaScript object on any page rendering the [booking_package] shortcode or widget, so any visitor can harvest it and call the unauthorized retrieval path; no authentication, user interaction, or special configuration is required per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. No CISA KEV listing was provided, and no public exploit identified at time of analysis, and the assessed impact is confidentiality-only (I:N/A:N), making this an actionable priority for sites actively using the plugin but not a top-tier emergency.
Unauthenticated SQL injection in the Booking Package WordPress plugin (versions up to and including 1.7.20, by developer masaakitanaka) lets remote attackers append SQL to an existing query via the 'email' form parameter on the /wp-json/booking-package/v1/request REST endpoint, enabling extraction of sensitive database contents. The endpoint is registered with permission_callback __return_true and REST-sourced $_POST values bypass wp_magic_quotes, so single quotes reach the SQL sink without authentication. Exploitability is severely constrained because the parameter is filtered through WordPress's is_email() before use, and there is no public exploit identified at time of analysis.
Privilege escalation in the Booking Package plugin for WordPress (versions up to and including 1.7.16) allows authenticated attackers with Editor-level access or above to take over any account, including Administrator accounts, by abusing the 'updateUser' branch of the package_app_action AJAX endpoint. The handler validates only a nonce and passes a hard-coded administrator flag to Schedule::updateUser(), letting attackers supply arbitrary target user IDs to wp_update_user() and reset the email and password of any account. No public exploit identified at time of analysis, but the issue was disclosed by Wordfence and results in full site compromise once an Editor account is obtained.
Stored cross-site scripting in the Booking Package WordPress plugin (versions up to and including 1.7.29) allows authenticated users with contributor-level access or higher to inject persistent JavaScript via the 'id' parameter, which executes when other users view the injected page. The flaw results from insufficient input sanitization and output escaping, and no public exploit has been identified at time of analysis. Exploitation requires an authenticated contributor account, and the impact is constrained to higher-privileged users who access the malicious content, making this a moderate-severity issue.
Booking Package plugin for WordPress up to version 1.7.06 allows unauthenticated attackers to manipulate booking prices via the intentForStripe() function, which accepts unsanitized $_POST['amount'] values and passes them directly to the Stripe PaymentIntent API without validation. The vulnerability is compounded by commented-out code in CreditCard.php that would normally enforce server-calculated pricing, enabling attackers to complete bookings at arbitrary prices (e.g., $0.01 instead of $500.00) with no authentication required. This is a confirmed price manipulation vulnerability with no active KEV exploitation reported but represents significant financial fraud risk.
Unauthenticated PII disclosure in the Booking Package WordPress plugin through version 1.7.29 lets remote attackers retrieve the booking_package_booked_customers table, exposing customer names, email addresses, phone numbers, physical addresses, and cancellation tokens. The endpoint's only nominal protection is a nonce that the plugin emits in the public booking_package JavaScript object on any page rendering the [booking_package] shortcode or widget, so any visitor can harvest it and call the unauthorized retrieval path; no authentication, user interaction, or special configuration is required per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. No CISA KEV listing was provided, and no public exploit identified at time of analysis, and the assessed impact is confidentiality-only (I:N/A:N), making this an actionable priority for sites actively using the plugin but not a top-tier emergency.
Unauthenticated SQL injection in the Booking Package WordPress plugin (versions up to and including 1.7.20, by developer masaakitanaka) lets remote attackers append SQL to an existing query via the 'email' form parameter on the /wp-json/booking-package/v1/request REST endpoint, enabling extraction of sensitive database contents. The endpoint is registered with permission_callback __return_true and REST-sourced $_POST values bypass wp_magic_quotes, so single quotes reach the SQL sink without authentication. Exploitability is severely constrained because the parameter is filtered through WordPress's is_email() before use, and there is no public exploit identified at time of analysis.
Privilege escalation in the Booking Package plugin for WordPress (versions up to and including 1.7.16) allows authenticated attackers with Editor-level access or above to take over any account, including Administrator accounts, by abusing the 'updateUser' branch of the package_app_action AJAX endpoint. The handler validates only a nonce and passes a hard-coded administrator flag to Schedule::updateUser(), letting attackers supply arbitrary target user IDs to wp_update_user() and reset the email and password of any account. No public exploit identified at time of analysis, but the issue was disclosed by Wordfence and results in full site compromise once an Editor account is obtained.
Stored cross-site scripting in the Booking Package WordPress plugin (versions up to and including 1.7.29) allows authenticated users with contributor-level access or higher to inject persistent JavaScript via the 'id' parameter, which executes when other users view the injected page. The flaw results from insufficient input sanitization and output escaping, and no public exploit has been identified at time of analysis. Exploitation requires an authenticated contributor account, and the impact is constrained to higher-privileged users who access the malicious content, making this a moderate-severity issue.
Booking Package plugin for WordPress up to version 1.7.06 allows unauthenticated attackers to manipulate booking prices via the intentForStripe() function, which accepts unsanitized $_POST['amount'] values and passes them directly to the Stripe PaymentIntent API without validation. The vulnerability is compounded by commented-out code in CreditCard.php that would normally enforce server-calculated pricing, enabling attackers to complete bookings at arbitrary prices (e.g., $0.01 instead of $500.00) with no authentication required. This is a confirmed price manipulation vulnerability with no active KEV exploitation reported but represents significant financial fraud risk.