CVE-2026-16986
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Booking Package WordPress plugin before version 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected charge from attacker-supplied request values instead, so an unauthenticated attacker can pay an arbitrary fraction of a service's real price.
Risk Assessment
The organization may experience financial losses due to underpayments for services, potentially leading to revenue loss. The attack does not require authentication, increasing the risk of exploitation.
Recommendation
It is recommended to update the Booking Package plugin to version 1.7.25 or later, which includes fixes for server-side payment amount validation.
Other vulnerabilities in Booking Package
See all- CVE-2026-15335High
The Booking Package plugin for WordPress up to version 1.7.20 is vulnerable to generic SQL injection via the 'email' form parameter (form<N>). Insufficient escaping and lack of query preparation allow unauthenticated attackers to append additional SQL queries, potentially extracting sensitive database information.
- CVE-2026-40774High
The Booking package versions <= 1.7.06 have an issue with unauthenticated access that allows for broken access control.
- CVE-2026-9851High
A vulnerability in the Booking Package plugin for WordPress up to version 1.7.16 allows privilege escalation via account takeover. Missing capability checks in the package_app_action AJAX endpoint let authenticated attackers with Editor-level access or above change the email and password of any account, including administrators.
Original NVD description (English source)
The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected charge from attacker-supplied request values instead, so an unauthenticated attacker can pay an arbitrary fraction of a service's real price.