Booking Package <= 1.7.31 - Unauthenticated Payment Bypass via Booking Submission
- ID
- WPSEC-2026-1084
- Plugin
- Booking Package (booking-package)
- Affected
- all versions before 1.7.32
- Remediation
- Update to 1.7.32 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-841
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-16
- Attack surface
- Booking Package on WPSec AttackSurface
- Fix released
- Published
Description
The Booking Package plugin for WordPress is vulnerable to payment bypass via the public booking submission in all versions up to, and including, 1.7.31, due to the booking being stored before payment was verified and the payment being processed only when the client-supplied 'payType' was exactly 'stripe' or 'paypal'. Any other 'payType', sent together with any non-empty 'payToken', skipped the charge even on calendars that only allow online payment. In addition, the Stripe payment confirmation treated any payment intent as paid when the client set the 'stripe_konbini' or 'stripe_paypay' flag, without checking the intent's payment method types or status. This makes it possible for unauthenticated attackers to create bookings on calendars that require Stripe or PayPal payment without paying.
References
- https://wpsec.com/vuln/WPSEC-2026-1084/
- https://plugins.svn.wordpress.org/booking-package/tags/1.7.32/
- https://wordpress.org/plugins/booking-package/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS