{
 "id": "WPSEC-2026-1380",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1380/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1380/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1380/index.md",
 "title": "Booking Package <= 1.7.32 - Unauthenticated Price Manipulation via Hotel Room Amounts and Cross-Calendar Services",
 "description": "The Booking Package plugin for WordPress is vulnerable to price manipulation via the public booking submission and payment intent creation in all versions up to, and including, 1.7.32, due to the plugin taking the per-room 'personAmount' and 'optionsAmount' values of accommodation (hotel) bookings from the client-supplied 'json' parameter and using them to compute the total cost and the amount charged, and due to service and guest records being looked up by key alone without checking that they belong to the booked calendar. This makes it possible for unauthenticated attackers to lower the price charged for a booking.",
 "plugin": {
  "slug": "booking-package",
  "name": "Booking Package",
  "full_name": "Booking Package",
  "wordpress_org": "https://wordpress.org/plugins/booking-package/",
  "advisories_url": "https://wpsec.com/vuln/plugin/booking-package/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/booking-package"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-472"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.7.33",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.7.33"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.7.33",
 "remediation": "Update to 1.7.33 or later.",
 "fix_released": "2026-10-19T04:42:36+00:00",
 "published": "2026-10-21T13:44:54+00:00",
 "updated": "2026-10-21T13:33:59.007581+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1380/",
  "https://plugins.svn.wordpress.org/booking-package/tags/1.7.33/",
  "https://wordpress.org/plugins/booking-package/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/booking-package",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-21"
 }
}