# Booking Package <= 1.7.32 - Unauthenticated Payment Bypass via Stripe Payment Amount Mismatch and Payment Reuse

- **ID:** WPSEC-2026-1379
- **Plugin:** Booking Package (`booking-package`), https://wordpress.org/plugins/booking-package/
- **Affected versions:** all versions before 1.7.33
- **Fixed in:** 1.7.33 (Update to 1.7.33 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-345
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/booking-package
- **Fix released:** 2026-10-19
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1379/

## Description

The Booking Package plugin for WordPress is vulnerable to payment bypass via the online payment step of the public booking submission in all versions up to, and including, 1.7.32, due to the plugin accepting a Stripe PaymentIntent based only on its ID and status, without confirming that the intent's amount matches the booking amount, and not checking whether a Stripe or PayPal payment had already been used for another booking. This makes it possible for unauthenticated attackers to pay for a cheaper booking and use that Stripe payment to complete a more expensive one, or to reuse one payment for several bookings, when online payment is enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-1379/
- https://plugins.svn.wordpress.org/booking-package/tags/1.7.33/
- https://wordpress.org/plugins/booking-package/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1379/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.