# CVE-2026-16986: Booking Package WordPress plugin price manipulation

Source: https://junglewise.ai/threats/cve-2026-16986-booking-package-wordpress-plugin-price-manipulation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-16986 · Severity: medium · CVSS 5.3 · Published 2026-08-26

The Booking Package WordPress plugin handles payment processing for booking services. An unauthenticated attacker can manipulate payment amounts by tampering with request parameters, allowing them to pay arbitrary fractions of the actual service price. This results in direct revenue loss for business owners using the plugin to sell services online.

Technologies: [Booking Package](https://junglewise.ai/threats/technologies/booking-package). Vendors: [Booking Package](https://junglewise.ai/threats/vendors/booking-package).

## Quick answers

**Is CVE-2026-16986 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16986 being exploited in the wild.

**How severe is CVE-2026-16986?** Medium severity, with a CVSS score of 5.3, published 26 August 2026.

**Which products and versions are affected?** Booking Package before 1.7.25.

**Is there a fix for CVE-2026-16986?** A patch was published on 2026-08-25: Fixed in version 1.7.25 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-16986 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-16986?** Check whether you run Booking Package at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a server-side validation bypass in price processing. The plugin derives the charge amount from attacker-supplied request values rather than validating against the authoritative server-side stored service prices. The flaw manifests in three distinct forms across versions: direct service cost manipulation (≤1.7.22), negative option cost injection (≤1.7.23), and option identity swapping via list reordering (≤1.7.24). An unauthenticated attacker with network access to the booking page can craft malicious requests to the payment processing endpoints (admin-ajax.php or REST API) to create payment intents or stored bookings at reduced rates. The vulnerability was fixed in version 1.7.25.

## Affected products

- Booking Package Booking Package before 1.7.25

## Timeline

- 2026-08-24: disclosed
- 2026-08-25: patched: Fixed in version 1.7.25
- 2026-08-26: advisory

## References

- [https://wpscan.com/vulnerability/8df11bf9-1878-4220-b13c-82e8dadc3a08/](https://wpscan.com/vulnerability/8df11bf9-1878-4220-b13c-82e8dadc3a08/)

## Related threats

- [Booking Package WordPress plugin payment bypass](https://junglewise.ai/threats/cve-2026-106000-the-booking-package-wordpress-plugin-before-1-7-34-does-not)
- [Booking Package WordPress plugin unauthenticated email sending](https://junglewise.ai/threats/cve-2026-105997-the-booking-package-wordpress-plugin-before-1-7-33-does-not)
- [Booking Package WordPress plugin missing authorization check](https://junglewise.ai/threats/cve-2026-105998-the-booking-package-wordpress-plugin-before-1-7-31-does-not)
- [Booking Package WordPress plugin stored cross-site scripting](https://junglewise.ai/threats/cve-2026-103425-the-booking-package-plugin-for-wordpress-is-vulnerable-to-stored)
- [Booking Package plugin for WordPress authorization bypass](https://junglewise.ai/threats/cve-2026-103423-the-booking-package-plugin-for-wordpress-is-vulnerable-to)