Booking Package vulnerabilities

The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose other customers' personal information and booking cancellation tokens.

The Booking Package WordPress plugin before version 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected charge from attacker-supplied request values instead, so an unauthenticated attacker can pay an arbitrary fraction of a service's real price.

The Booking Package plugin for WordPress up to version 1.7.20 is vulnerable to generic SQL injection via the 'email' form parameter (form<N>). Insufficient escaping and lack of query preparation allow unauthenticated attackers to append additional SQL queries, potentially extracting sensitive database information.

The Booking package versions <= 1.7.06 have an issue with unauthenticated access that allows for broken access control.

A vulnerability in the Booking Package plugin for WordPress up to version 1.7.16 allows privilege escalation via account takeover. Missing capability checks in the package_app_action AJAX endpoint let authenticated attackers with Editor-level access or above change the email and password of any account, including administrators.