{
 "id": "WPSEC-2026-1084",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1084/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1084/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1084/index.md",
 "title": "Booking Package <= 1.7.31 - Unauthenticated Payment Bypass via Booking Submission",
 "description": "The Booking Package plugin for WordPress is vulnerable to payment bypass via the public booking submission in all versions up to, and including, 1.7.31, due to the booking being stored before payment was verified and the payment being processed only when the client-supplied 'payType' was exactly 'stripe' or 'paypal'. Any other 'payType', sent together with any non-empty 'payToken', skipped the charge even on calendars that only allow online payment. In addition, the Stripe payment confirmation treated any payment intent as paid when the client set the 'stripe_konbini' or 'stripe_paypay' flag, without checking the intent's payment method types or status. This makes it possible for unauthenticated attackers to create bookings on calendars that require Stripe or PayPal payment without paying.",
 "plugin": {
  "slug": "booking-package",
  "name": "Booking Package",
  "full_name": "Booking Package",
  "wordpress_org": "https://wordpress.org/plugins/booking-package/",
  "advisories_url": "https://wpsec.com/vuln/plugin/booking-package/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/booking-package"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-841"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.7.32",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.7.32"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.7.32",
 "remediation": "Update to 1.7.32 or later.",
 "fix_released": "2026-10-15T03:53:57+00:00",
 "published": "2026-10-16T11:46:25+00:00",
 "updated": "2026-10-16T10:56:23.145802+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1084/",
  "https://plugins.svn.wordpress.org/booking-package/tags/1.7.32/",
  "https://wordpress.org/plugins/booking-package/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/booking-package",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-16"
 }
}