CVE-2026-16986: Booking Package < 1.7.25 - Unauthenticated Price Manipulation via Service and Option Cost Parameters
The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected charge from attacker-supplied request values instead, so an unauthenticated attacker can pay an arbitrary fraction of a service's real price.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated user who can submit a booking payment request is potentially able to exploit it. No account or prior authorization is required.
What attacker-controlled data is involved?
The vulnerable plugin derives the expected payment amount from service and option cost values supplied in the request. An attacker can manipulate those values to pay only an arbitrary fraction of the stored service price.
Are installations running version 1.7.25 affected?
The issue affects Booking Package versions before 1.7.25. The provided information does not identify any other affected versions or configurations.