# Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.8.0 - Unauthenticated Price Manipulation via Booking Form Quantity Parameters

- **ID:** WPSEC-2026-0975
- **Plugin:** Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment (`booking-and-rental-manager-for-woocommerce`), https://wordpress.org/plugins/booking-and-rental-manager-for-woocommerce/
- **Affected versions:** all versions before 2.8.1
- **Fixed in:** 2.8.1 (Update to 2.8.1 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-1284
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-15)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/booking-and-rental-manager-for-woocommerce
- **Fix released:** 2026-10-14
- **Published:** 2026-10-15
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0975/

## Description

The Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment plugin for WordPress is vulnerable to price manipulation via the quantity values posted from the booking forms (such as room, rental type and extra service quantities) in all versions up to, and including, 2.8.0. This is due to insufficient validation that submitted quantities are non-negative whole numbers before they are multiplied into the booking price. This makes it possible for unauthenticated attackers to add bookings to the cart with fractional or negative quantities, so that a booking is priced at a fraction of its real value, at zero or below.

## References

- https://wpsec.com/vuln/WPSEC-2026-0975/
- https://plugins.svn.wordpress.org/booking-and-rental-manager-for-woocommerce/tags/2.8.1/
- https://wordpress.org/plugins/booking-and-rental-manager-for-woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0975/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.