CVE-2026-92408: WPS Bookings for WooCommerce < 3.13.1 - Unauthenticated Price Manipulation via booking_price

Q: Who can exploit this issue?

Any unauthenticated remote user can exploit it. No account, special privileges, or user interaction is required.

Q: What configuration is affected?

Sites using WPS Bookings for WooCommerce with bookable services are affected when running a version earlier than 3.13.1. The vulnerable behavior involves the user-controlled booking_price value used to set a product price.

Q: What can an attacker do?

An attacker can manipulate the price charged for a bookable service and may set it to an amount of their choosing, including zero. The issue affects transaction integrity rather than confidentiality or service availability.

Q: How can I determine whether my site is exposed?

Check whether WPS Bookings for WooCommerce is installed and whether its version is earlier than 3.13.1. Also review whether the site offers bookable services through the plugin, since those purchases may accept the booking_price input.

Published Nov 11, 2026

Updated

The WPS Bookings for WooCommerce WordPress plugin before 3.13.1 does not validate a price value taken from user input before using it to set the product price, allowing unauthenticated users to purchase bookable services at a price of their choosing, including zero.

Affected Software

1 affected component

wps WPS Bookings for WooCommerce<3.13.1

Event History

Nov 11, 2026

CVE Published

via MITRE·07:33 AM

Data Sourced

via MITRE·07:33 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated remote user can exploit it. No account, special privileges, or user interaction is required.

What configuration is affected?

Sites using WPS Bookings for WooCommerce with bookable services are affected when running a version earlier than 3.13.1. The vulnerable behavior involves the user-controlled booking_price value used to set a product price.

What can an attacker do?

An attacker can manipulate the price charged for a bookable service and may set it to an amount of their choosing, including zero. The issue affects transaction integrity rather than confidentiality or service availability.

How can I determine whether my site is exposed?

Check whether WPS Bookings for WooCommerce is installed and whether its version is earlier than 3.13.1. Also review whether the site offers bookable services through the plugin, since those purchases may accept the booking_price input.

CVE-2026-92408: WPS Bookings for WooCommerce < 3.13.1 - Unauthenticated Price Manipulation via booking_price

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What configuration is affected?

What can an attacker do?

How can I determine whether my site is exposed?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What configuration is affected?

What can an attacker do?

How can I determine whether my site is exposed?