{
 "id": "WPSEC-2026-0785",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0785/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0785/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0785/index.md",
 "title": "Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.28 - Unauthenticated Payment Amount Manipulation via Order Currency",
 "description": "The Booktics – Appointment Booking Calendar for Service Businesses plugin for WordPress is vulnerable to payment amount manipulation via the 'currency' parameter of the order creation REST endpoint in all versions up to, and including, 1.0.28. This is due to the plugin storing the buyer-supplied currency on the order, charging the server-computed total in that currency through Stripe, and marking the order paid when the PaymentIntent succeeds without checking the amount or currency that was captured. This makes it possible for unauthenticated attackers to have the order total charged in a much lower-value currency (for example, 100 KRW instead of 100 USD) and still have the booking confirmed as paid when Stripe payments are enabled.",
 "plugin": {
  "slug": "booktics",
  "name": "Booktics – Appointment Booking Calendar for Service Businesses",
  "full_name": "Booktics – Appointment Booking Calendar for Service Businesses",
  "wordpress_org": "https://wordpress.org/plugins/booktics/",
  "advisories_url": "https://wpsec.com/vuln/plugin/booktics/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/booktics"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-472"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.0.29",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.0.29"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.0.29",
 "remediation": "Update to 1.0.29 or later.",
 "fix_released": "2026-10-11T10:01:32+00:00",
 "published": "2026-10-12T10:47:41+00:00",
 "updated": "2026-10-12T09:38:16.911120+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0785/",
  "https://plugins.svn.wordpress.org/booktics/tags/1.0.29/",
  "https://wordpress.org/plugins/booktics/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/booktics",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-12"
 }
}