Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.8.0 - Unauthenticated Price Manipulation via Booking Form Quantity Parameters
- ID
- WPSEC-2026-0975
- Plugin
- Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment (booking-and-rental-manager-for-woocommerce)
- Affected
- all versions before 2.8.1
- Remediation
- Update to 2.8.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-1284
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-15
- Attack surface
- Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment on WPSec AttackSurface
- Fix released
- Published
Description
The Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment plugin for WordPress is vulnerable to price manipulation via the quantity values posted from the booking forms (such as room, rental type and extra service quantities) in all versions up to, and including, 2.8.0. This is due to insufficient validation that submitted quantities are non-negative whole numbers before they are multiplied into the booking price. This makes it possible for unauthenticated attackers to add bookings to the cart with fractional or negative quantities, so that a booking is priced at a fraction of its real value, at zero or below.
References
- https://wpsec.com/vuln/WPSEC-2026-0975/
- https://plugins.svn.wordpress.org/booking-and-rental-manager-for-woocommerce/tags/2.8.1/
- https://wordpress.org/plugins/booking-and-rental-manager-for-woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS