The Appointment Hour Booking WordPress plugin prior to version 1.5.88 lacks server‑side validation of the booking price supplied by a client. An unauthenticated user can send a crafted request containing a tcost parameter with any numeric value, including zero or negative numbers. The plugin stores this value as the final price for the booking, effectively corrupting booking and payment records and undermining the integrity of the data and revenue flow.

This vulnerability affects installations of the Appointment Hour Booking plugin that are using any version earlier than 1.5.88. The CNA vendor is listed as Unknown: Appointment Hour Booking; no specific vendor or product name beyond the plugin is available.

The exploit does not require user authentication, making it highly likely that automated attacks could be launched simply by repeatedly submitting manipulated tcost values. While an EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, its impact on financial data and the ease of exploitation suggest a high risk profile. The likely attack vector is submitting a crafted HTTP request to the booking endpoint with arbitrary tcost values, which the plugin accepts without validation.