Booking Package <= 1.7.32 - Unauthenticated Payment Bypass via Stripe Payment Amount Mismatch and Payment Reuse
- ID
- WPSEC-2026-1379
- Plugin
- Booking Package (booking-package)
- Affected
- all versions before 1.7.33
- Remediation
- Update to 1.7.33 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-345
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-21
- Attack surface
- Booking Package on WPSec AttackSurface
- Fix released
- Published
Description
The Booking Package plugin for WordPress is vulnerable to payment bypass via the online payment step of the public booking submission in all versions up to, and including, 1.7.32, due to the plugin accepting a Stripe PaymentIntent based only on its ID and status, without confirming that the intent's amount matches the booking amount, and not checking whether a Stripe or PayPal payment had already been used for another booking. This makes it possible for unauthenticated attackers to pay for a cheaper booking and use that Stripe payment to complete a more expensive one, or to reuse one payment for several bookings, when online payment is enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-1379/
- https://plugins.svn.wordpress.org/booking-package/tags/1.7.33/
- https://wordpress.org/plugins/booking-package/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS