# Booking Package <= 1.7.31 - Unauthenticated Payment Bypass via Booking Submission

- **ID:** WPSEC-2026-1084
- **Plugin:** Booking Package (`booking-package`), https://wordpress.org/plugins/booking-package/
- **Affected versions:** all versions before 1.7.32
- **Fixed in:** 1.7.32 (Update to 1.7.32 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-841
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/booking-package
- **Fix released:** 2026-10-15
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1084/

## Description

The Booking Package plugin for WordPress is vulnerable to payment bypass via the public booking submission in all versions up to, and including, 1.7.31, due to the booking being stored before payment was verified and the payment being processed only when the client-supplied 'payType' was exactly 'stripe' or 'paypal'. Any other 'payType', sent together with any non-empty 'payToken', skipped the charge even on calendars that only allow online payment. In addition, the Stripe payment confirmation treated any payment intent as paid when the client set the 'stripe_konbini' or 'stripe_paypay' flag, without checking the intent's payment method types or status. This makes it possible for unauthenticated attackers to create bookings on calendars that require Stripe or PayPal payment without paying.

## References

- https://wpsec.com/vuln/WPSEC-2026-1084/
- https://plugins.svn.wordpress.org/booking-package/tags/1.7.32/
- https://wordpress.org/plugins/booking-package/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1084/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.