The WP Hotel Booking WordPress plugin prior to version 2.3.3 fails to enforce that room quantities and the derived total amount are non‑negative during booking creation. By trusting client‑supplied cart data, the plugin allows an unauthenticated user to submit a booking request with zero or negative quantities, which the system accepts as a confirmed reservation with a free or arbitrarily reduced cost. This weakness originates from improper input validation and integer underflow bugs (CWE‑20 and CWE‑472), enabling a payment bypass that undermines the financial integrity of the booking service.

Any WordPress site that has installed the WP Hotel Booking plugin with a version older than 2.3.3 is affected. The plugin is commonly used for managing hotel reservations, so the vulnerability applies to all installations using those versions.

The CVSS score of 5.3 indicates moderate vulnerability. The EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild, and the flaw is not currently listed in CISA’s KEV catalog. Based on the description, the likely attack vector is by sending crafted HTTP requests that manipulate cart data to include negative or zero room quantities; authentication is not required, and the exploit can be performed remotely from any network that can reach the WordPress site.