# Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.28 - Unauthenticated Payment Amount Manipulation via Order Currency

- **ID:** WPSEC-2026-0785
- **Plugin:** Booktics – Appointment Booking Calendar for Service Businesses (`booktics`), https://wordpress.org/plugins/booktics/
- **Affected versions:** all versions before 1.0.29
- **Fixed in:** 1.0.29 (Update to 1.0.29 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-472
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/booktics
- **Fix released:** 2026-10-11
- **Published:** 2026-10-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0785/

## Description

The Booktics – Appointment Booking Calendar for Service Businesses plugin for WordPress is vulnerable to payment amount manipulation via the 'currency' parameter of the order creation REST endpoint in all versions up to, and including, 1.0.28. This is due to the plugin storing the buyer-supplied currency on the order, charging the server-computed total in that currency through Stripe, and marking the order paid when the PaymentIntent succeeds without checking the amount or currency that was captured. This makes it possible for unauthenticated attackers to have the order total charged in a much lower-value currency (for example, 100 KRW instead of 100 USD) and still have the booking confirmed as paid when Stripe payments are enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-0785/
- https://plugins.svn.wordpress.org/booktics/tags/1.0.29/
- https://wordpress.org/plugins/booktics/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0785/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.