{
 "id": "WPSEC-2026-1379",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1379/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1379/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1379/index.md",
 "title": "Booking Package <= 1.7.32 - Unauthenticated Payment Bypass via Stripe Payment Amount Mismatch and Payment Reuse",
 "description": "The Booking Package plugin for WordPress is vulnerable to payment bypass via the online payment step of the public booking submission in all versions up to, and including, 1.7.32, due to the plugin accepting a Stripe PaymentIntent based only on its ID and status, without confirming that the intent's amount matches the booking amount, and not checking whether a Stripe or PayPal payment had already been used for another booking. This makes it possible for unauthenticated attackers to pay for a cheaper booking and use that Stripe payment to complete a more expensive one, or to reuse one payment for several bookings, when online payment is enabled.",
 "plugin": {
  "slug": "booking-package",
  "name": "Booking Package",
  "full_name": "Booking Package",
  "wordpress_org": "https://wordpress.org/plugins/booking-package/",
  "advisories_url": "https://wpsec.com/vuln/plugin/booking-package/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/booking-package"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-345"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.7.33",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.7.33"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.7.33",
 "remediation": "Update to 1.7.33 or later.",
 "fix_released": "2026-10-19T04:42:36+00:00",
 "published": "2026-10-21T13:44:54+00:00",
 "updated": "2026-10-21T13:33:59.007581+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1379/",
  "https://plugins.svn.wordpress.org/booking-package/tags/1.7.33/",
  "https://wordpress.org/plugins/booking-package/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/booking-package",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-21"
 }
}