Description

The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected charge from attacker-supplied request values instead, so an unauthenticated attacker can pay an arbitrary fraction of a service's real price.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-26T06:16:25.500Z",
  "pubdate": "2026-08-26T06:16:25.500Z",
  "executiveSummary": "The Booking Package WordPress plugin, in versions prior to 1.7.25, is susceptible to an Improper Input Validation vulnerability. This flaw allows unauthenticated remote attackers to manipulate payment amounts during the checkout process.\nThe vulnerability arises because the server fails to perform integrity verification on the payment amount against the legitimate service price stored in the backend database. Instead, the application trusts and processes the payment value provided directly within the client-side HTTP request.\nSuccessful exploitation permits an attacker to pay an arbitrary, significantly reduced fraction of the actual service cost, resulting in financial loss for the site administrator and potential service unauthorized access. No authentication or elevated privileges are required to initiate this attack, making it a critical threat to e-commerce functionality within the affected WordPress environment.",
  "technicalDetails": "The root cause of this vulnerability is a lack of server-side validation regarding financial transaction parameters within the Booking Package plugin's payment processing workflow. In a secure implementation, the price of a service must be retrieved exclusively from the server-side database based on a session-linked service identifier. However, the affected versions of Booking Package derive the expected transaction amount from user-controllable input fields submitted via HTTP POST/GET requests.\nThe attack flow begins with an unauthenticated user initiating a booking for a specific service. During the transaction submission phase, the client application transmits a request to the server that includes the payment amount. Because the application logic fails to cross-reference this incoming value against the authoritative price stored in the database, the server accepts the manipulated amount as the ground truth for the payment gateway interaction.\nAn attacker can intercept this traffic using an HTTP proxy, such as Burp Suite or OWASP ZAP. By modifying the parameter representing the cost (e.g., changing the amount to $0.01) before the request reaches the payment gateway, the attacker forces the system to initiate a transaction for the altered, lower value. Once the payment gateway receives the request for the modified amount, it processes the payment as a successful transaction for the service, despite the payment being drastically lower than the actual price.\nThis vulnerability is classified as a logic flaw in the payment processing component. Since the application does not implement a 'price lock' or server-side verification check, the integrity of the checkout process is entirely dependent on the client-side inputs, which are inherently untrusted. The impact is significant, as it bypasses standard revenue collection mechanisms, allowing for unauthorized service acquisition at a fractional cost. There are no complex prerequisites or interaction requirements beyond the ability to interact with the target site's booking interface and perform basic traffic interception."
}