Executive brief
The Booking Package WordPress plugin handles payment processing for booking services. An unauthenticated attacker can manipulate payment amounts by tampering with request parameters, allowing them to pay arbitrary fractions of the actual service price. This results in direct revenue loss for business owners using the plugin to sell services online.
Technical details
The vulnerability is a server-side validation bypass in price processing. The plugin derives the charge amount from attacker-supplied request values rather than validating against the authoritative server-side stored service prices. The flaw manifests in three distinct forms across versions: direct service cost manipulation (≤1.7.22), negative option cost injection (≤1.7.23), and option identity swapping via list reordering (≤1.7.24). An unauthenticated attacker with network access to the booking page can craft malicious requests to the payment processing endpoints (admin-ajax.php or REST API) to create payment intents or stored bookings at reduced rates. The vulnerability was fixed in version 1.7.25.
Affected products
- Booking Package Booking Package before 1.7.25
Timeline
- 2026-08-24: disclosed
- 2026-08-25: patched: Fixed in version 1.7.25
- 2026-08-26: advisory