Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.28 - Unauthenticated Payment Amount Manipulation via Order Currency
- ID
- WPSEC-2026-0785
- Plugin
- Booktics – Appointment Booking Calendar for Service Businesses (booktics)
- Affected
- all versions before 1.0.29
- Remediation
- Update to 1.0.29 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-472
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-12
- Attack surface
- Booktics – Appointment Booking Calendar for Service Businesses on WPSec AttackSurface
- Fix released
- Published
Description
The Booktics – Appointment Booking Calendar for Service Businesses plugin for WordPress is vulnerable to payment amount manipulation via the 'currency' parameter of the order creation REST endpoint in all versions up to, and including, 1.0.28. This is due to the plugin storing the buyer-supplied currency on the order, charging the server-computed total in that currency through Stripe, and marking the order paid when the PaymentIntent succeeds without checking the amount or currency that was captured. This makes it possible for unauthenticated attackers to have the order total charged in a much lower-value currency (for example, 100 KRW instead of 100 USD) and still have the booking confirmed as paid when Stripe payments are enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-0785/
- https://plugins.svn.wordpress.org/booktics/tags/1.0.29/
- https://wordpress.org/plugins/booktics/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS