PT-2026-35680 · WordPress · Booking Package

Momopon1415 · Published 2026-04-28 · Updated 2026-04-29 · CVE-2026-4911

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Booking Package versions prior to 1.7.07

Description Price Manipulation occurs because the intentForStripe() function passes the user-controlled $ POST['amount'] variable directly to the Stripe PaymentIntent API without validation. Additionally, the commitStripe() function ignores the server-calculated amount during payment confirmation. Although the getAmount() function correctly calculates costs based on services, guests, taxes, and coupons, this value is not validated against the PaymentIntent because the necessary code in CreditCard.php is commented out. This allows unauthenticated attackers to book services at arbitrary prices by manipulating the amount parameter during PaymentIntent creation.

Recommendations Update the plugin to a version later than 1.7.06.

Fix

Weakness Enumeration

CWE-472

Related Identifiers

CVE-2026-4911

Affected Products

Booking Package

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2026-4911 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/61d63c5a-6ca6-42d8-ab0a-152d9c95945c?source=cve · Note
• https://twitter.com/VulmonFeeds/status/2049149880258433033 · Twitter Post
• https://plugins.trac.wordpress.org/browser/booking-package/trunk/lib/Schedule.php#L15151 · Note
• https://plugins.trac.wordpress.org/browser/booking-package/tags/1.7.04/lib/CreditCard.php#L393 · Note
• https://plugins.trac.wordpress.org/browser/booking-package/trunk/lib/Schedule.php#L8942 · Note
• https://plugins.trac.wordpress.org/browser/booking-package/tags/1.7.04/lib/Schedule.php#L15151 · Note
• https://plugins.trac.wordpress.org/browser/booking-package/tags/1.7.04/lib/CreditCard.php#L548 · Note
• https://plugins.trac.wordpress.org/browser/booking-package/trunk/lib/CreditCard.php#L390 · Note
• https://plugins.trac.wordpress.org/browser/booking-package/trunk/lib/CreditCard.php#L545 · Note
• https://plugins.trac.wordpress.org/changeset?old_path=%2Fbooking-package/tags/1.7.06&new_path=%2Fbooking-package/tags/1.7.07 · Note
• https://t.me/CVEtracker/52058 · Telegram Post
• https://plugins.trac.wordpress.org/browser/booking-package/tags/1.7.04/lib/Schedule.php#L8948 · Note
• https://twitter.com/vuldb/status/2049343312566632668 · Twitter Post