Description

The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to have their bookings marked as fully paid without any payment reaching the site owner.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-06T22:16:47.687Z",
  "pubdate": "2026-08-06T22:16:47.687Z",
  "executiveSummary": "An input validation vulnerability exists in the WP Hotel Booking WordPress plugin prior to version 2.3.2, categorized as an improper payment verification flaw. The vulnerability allows unauthenticated remote attackers to manipulate the booking fulfillment process by sending forged payment notifications to the application. Because the affected software fails to cryptographically or logically verify that the payment notification corresponds to a legitimate transaction originating from the site owner's designated merchant account, and similarly fails to validate that the remitted currency amount matches the associated booking total, attackers can fraudulently alter booking states. The primary business impact involves financial loss and unauthorized service acquisition, as malicious actors can force the system to register bookings as fully paid without transferring any funds. The risk implication is critical for affected e-commerce and booking platforms utilizing vulnerable plugin versions, as exploitation requires no prior authentication, privileged access, or interaction with legitimate payment gateways. Attackers require network access to the target web application endpoints handling payment callbacks or notifications in order to replay or forge HTTP requests mimicking legitimate payment provider callbacks.",
  "technicalDetails": "The root cause of this vulnerability lies in the lack of robust server-side validation logic within the payment processing and notification handling components of the WP Hotel Booking WordPress plugin for versions before 2.3.2. Specifically, when payment gateways transmit asynchronous notification callbacks, IPN messages, or webhook payloads to the site, the plugin's notification processing routines accept the incoming data stream without adequately confirming the authenticity of the transaction against the payment gateway API or merchant ledger.\nThe vulnerability specifically manifests due to two distinct logic flaws: the absence of merchant account validation and the omission of transaction amount verification. During the attack flow, an unauthenticated attacker initiates a standard reservation or booking process within the target WordPress environment to generate a valid booking identifier. Rather than proceeding to complete the financial transaction through the legitimate third-party payment processor, the attacker crafts a forged HTTP POST or GET request destined for the plugin's payment notification handling endpoint. This crafted payload simulates a successful transaction callback from the payment gateway.\nBecause the vulnerable component fails to verify that the recipient merchant ID embedded in or associated with the notification matches the site owner's configured merchant account, and because it omits cross-referencing the paid amount against the actual database record for the booking total, the application blindly trusts the incoming parameters. The payload behavior instructs the backend database to update the booking status parameter to a fully paid state. Consequently, the internal state machine of the WP Hotel Booking plugin marks the reservation as completed and paid in full. The post-exploitation impact includes unauthorized resource utilization, complete bypass of the payment gateway workflow, and potential inventory exhaustion without any corresponding capital acquisition by the site operator. The attack vector is fully network-exploitable over HTTP/HTTPS protocols without requiring user interaction, session tokens, or specialized privileges."
}