Booking Package <= 1.7.32 - Unauthenticated Price Manipulation via Hotel Room Amounts and Cross-Calendar Services
- ID
- WPSEC-2026-1380
- Plugin
- Booking Package (booking-package)
- Affected
- all versions before 1.7.33
- Remediation
- Update to 1.7.33 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-472
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-21
- Attack surface
- Booking Package on WPSec AttackSurface
- Fix released
- Published
Description
The Booking Package plugin for WordPress is vulnerable to price manipulation via the public booking submission and payment intent creation in all versions up to, and including, 1.7.32, due to the plugin taking the per-room 'personAmount' and 'optionsAmount' values of accommodation (hotel) bookings from the client-supplied 'json' parameter and using them to compute the total cost and the amount charged, and due to service and guest records being looked up by key alone without checking that they belong to the booked calendar. This makes it possible for unauthenticated attackers to lower the price charged for a booking.
References
- https://wpsec.com/vuln/WPSEC-2026-1380/
- https://plugins.svn.wordpress.org/booking-package/tags/1.7.33/
- https://wordpress.org/plugins/booking-package/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS