The WP Hotel Booking plugin fails to validate that room quantities are non‑negative and that the resulting total price is correct when a booking is submitted. As a result, an unauthenticated visitor can manipulate the cart data on the client side to create confirmed reservations for free or at a greatly reduced price.

Any WordPress installation using the WP Hotel Booking plugin with a version earlier than 2.3.3 is affected; the vulnerability does not apply to later releases.

The CVSS score of 5.3 classifies this as a moderate severity issue. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalogue, indicating a relatively low likelihood of widespread exploitation. The likely attack vector is via crafted web requests that specify negative or zero room quantities, as the plugin relies on client‑controlled cart data without verifying the legitimacy of the values.