Arbitrary Price Manipulation in Booking Package WordPress Plugin

Executive Summary

This vulnerability affects the Booking Package WordPress plugin before version 1.7.25. It allows an unauthenticated attacker to manipulate the payment amount server-side by supplying arbitrary values in their request. Instead of validating the payment against the actual service price, the plugin derives the expected charge from the attacker-controlled input, enabling them to pay a fraction of the real price.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Booking Package WordPress plugin version is below 1.7.25. Inspect server-side payment processing logic for improper validation of payment amounts against stored service prices. Look for unusual transaction records where paid amounts are significantly lower than expected service costs.

Useful 0 Not Useful 0

Impact Analysis

If you use the affected Booking Package plugin, an attacker could exploit this to pay less than the actual price for services. This could lead to financial losses for service providers using the plugin. Additionally, it may undermine trust in payment processing and cause disputes over transactions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with financial regulations and data protection standards by enabling unauthorized price manipulation during transactions. Under GDPR, improper payment handling may affect data integrity and financial processing controls. HIPAA compliance could be affected if the plugin processes protected health information payments, as incorrect charges may violate security and financial safeguards.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Booking Package WordPress plugin to version 1.7.25 or later to ensure proper server-side validation of payment amounts against stored service prices.

Useful 0 Not Useful 0