Skip to content
Sign in
5.3 Medium

CVE-2026-16986 The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored…

Description

The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected charge from attacker-supplied request values instead, so an unauthenticated attacker can pay an arbitrary fraction of a service's real price.

Affected products and versions

Product Affected versions Fixed in
Booking Package 1.7 earliest → < 1.7.25 1.7.25

Other CVEs of Booking Package

The 7 CVEs of Booking Package →
CVE-2026-106000 Booking Package < 1.7.34 - Unauthenticated Payment Bypass 5.3 Medium CVE-2026-105997 The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code… 5.3 Medium CVE-2026-105999 The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning… 5.3 Medium CVE-2026-105996 The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source… 4.8 Medium
Track this CVE