The vulnerability allows an unauthenticated user to trick the plugin into marking a booking as fully paid without the actual funds being received. It arises because the plugin fails to confirm that a payment notification originates from the site’s own PayPal merchant account and that the payment amount equals the booking total, effectively bypassing the normally required financial verification step. This flaw can lead to fraudulent bookings being confirmed and wasted resources for the site owner.

Any installation of the WP Hotel Booking WordPress plugin with a version older than 2.3.2 is vulnerable. The issue affects all current users running the plugin at the time of this assessment, regardless of additional security layers, because the core verification logic is missing in all pre‑2.3.2 releases.

The CVSS score of 5.3 indicates moderate severity. There is no available EPSS data and the vulnerability is not listed in CISA KEV, which suggests a lower likelihood of mass exploitation at present. However, because the flaw can be exploited by sending crafted payment notifications from a PayPal IPN endpoint or by directly altering booking status, the potential impact on financial integrity and trustworthiness of the booking system is significant. The likely attack vector is the PayPal Instant Payment Notification interface exposed to the website, which can be manipulated by an attacker with knowledge of the plugin’s URL patterns.