# Booking Package <= 1.7.32 - Unauthenticated Price Manipulation via Hotel Room Amounts and Cross-Calendar Services

- **ID:** WPSEC-2026-1380
- **Plugin:** Booking Package (`booking-package`), https://wordpress.org/plugins/booking-package/
- **Affected versions:** all versions before 1.7.33
- **Fixed in:** 1.7.33 (Update to 1.7.33 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-472
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/booking-package
- **Fix released:** 2026-10-19
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1380/

## Description

The Booking Package plugin for WordPress is vulnerable to price manipulation via the public booking submission and payment intent creation in all versions up to, and including, 1.7.32, due to the plugin taking the per-room 'personAmount' and 'optionsAmount' values of accommodation (hotel) bookings from the client-supplied 'json' parameter and using them to compute the total cost and the amount charged, and due to service and guest records being looked up by key alone without checking that they belong to the booked calendar. This makes it possible for unauthenticated attackers to lower the price charged for a booking.

## References

- https://wpsec.com/vuln/WPSEC-2026-1380/
- https://plugins.svn.wordpress.org/booking-package/tags/1.7.33/
- https://wordpress.org/plugins/booking-package/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1380/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.