The Ettrick Escape Room Booking WordPress plugin before version 1.3.1 fails to verify a booking’s payment status with its payment provider before marking the booking as paid and confirmed. This flaw allows attackers to trigger the confirmation endpoint without any authentication, causing the plugin to treat an unpaid booking as paid. This is an authorization bypass that enables fraudulent reservations without completing payment, leading to direct financial loss for site owners.

Vendors: Ettrick Escape Room Booking (WordPress plugin). Product: Ettrick Escape Room Booking plugin. All installations running any version prior to 1.3.1 are vulnerable. No specific operating system or WordPress version exclusions are mentioned.

Based on the description, it is inferred that the booking confirmation endpoint is publicly accessible, allowing any remote actor to send HTTP requests without authentication. Because the plugin does not check payment verification, the attack surface is wide. The EPSS score is <1 %, indicating a low probability of exploitation. The issue is not listed in CISA KEV, but the lack of a verification step indicates significant potential for abuse. The CVSS score of 5.3 reflects a moderate risk. The exploitation could result in direct financial loss even if administrators eventually detect the fraud.