CVE-2026-16282: Appointment Hour Booking < 1.5.88 - Unauthenticated Booking Price Manipulation via tcost Parameter
The Appointment Hour Booking WordPress plugin before 1.5.88 does not validate a client-supplied booking price against the server-side configured service price, allowing unauthenticated users to submit an arbitrary final price (including zero or negative) that is stored as the authoritative booking price, corrupting booking and payment records.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Appointment Hour Booking WordPress pluginto a version that resolves this vulnerability.Fixed in 1.5.88
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16282?
CVE-2026-16282 has a risk score of 54, indicating a moderate level of severity.
How do I fix CVE-2026-16282?
To fix CVE-2026-16282, update the Appointment Hour Booking plugin to version 1.5.88 or later.
What type of vulnerability is CVE-2026-16282?
CVE-2026-16282 is an unauthenticated booking price manipulation vulnerability that affects versions of the Appointment Hour Booking plugin prior to 1.5.88.
Can CVE-2026-16282 be exploited by unauthenticated users?
Yes, CVE-2026-16282 allows unauthenticated users to manipulate booking prices.
What impact does CVE-2026-16282 have on systems using the Appointment Hour Booking plugin?
CVE-2026-16282 can result in financial loss due to manipulation of booking prices, allowing users to set arbitrary low or negative prices.