CVE-2026-4911
Price Manipulation in Booking Package WordPress Plugin via Stripe API
Publication date: 2026-04-28
Last updated on: 2026-04-28
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| booking_package | booking_package | to 1.7.06 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-472 | The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Booking Package plugin for WordPress has a vulnerability in versions up to and including 1.7.06 that allows price manipulation. This happens because the intentForStripe() function takes the user-controlled amount value from a POST request and sends it directly to the Stripe PaymentIntent API without validating it. Additionally, the commitStripe() function does not use the server-calculated booking amount when confirming the payment. Although the server calculates the correct booking cost based on services, guests, taxes, and coupons, this amount is never checked against or used to update the PaymentIntent because the relevant code is commented out. As a result, attackers can manipulate the amount parameter to pay arbitrary prices, such as $0.01 instead of the actual cost.
How can this vulnerability impact me? :
This vulnerability allows unauthenticated attackers to book services at fraudulent prices by manipulating the payment amount during the Stripe PaymentIntent creation. This can lead to financial losses for the service provider because attackers can pay much less than the actual booking cost or potentially bypass payment altogether.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to manipulate payment amounts when booking services, potentially leading to fraudulent transactions.
However, there is no information provided about how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.