Technical impact
The vulnerability allows an unauthenticated attacker to modify the $_POST['amount'] value sent to the Stripe PaymentIntent API, bypassing the server‑side calculation of booking costs. Because the code that would normally set the calculated amount is commented out, the payment is processed with the tampered value, enabling the attacker to complete a booking for an arbitrary low price. This can lead to significant financial loss for the business operating the Booking Package plugin. The weakness is a lack of input validation and validation of critical payment data, as identified by CWE‑472.
Affected Systems
All installations of the WordPress Booking Package plugin version 1.7.06 or earlier. Any WordPress site using these versions is exposed to the flaw until an update replaces the vulnerable code paths, specifically those within CreditCard.php and Schedule.php that handle the Stripe PaymentIntent creation and confirmation.
Risk and Exploitability
The CVSS score of 5.3 indicates a moderate severity, but the vulnerability is exploitable without authentication, making the risk higher in practice. EPSS information is not available and the issue is not listed in the CISA KEV catalog. The likely attack vector is inferred from the description to be through the public booking interface, where an attacker can submit a crafted POST request to the payment processing endpoint. Once executed, the attacker can complete the booking with an artificially low amount and claim the services, while the payment is recorded as successful by Stripe. Because no user credentials are required, the exploitation likelihood is non‑negligible for any site exposing the booking form.
