CVE-2026-4911: Booking Package Plugin Price Manipulation

CVE-2026-4911 Overview

The Booking Package plugin for WordPress contains a Price Manipulation vulnerability in versions up to and including 1.7.06. This business logic flaw allows unauthenticated attackers to book services at arbitrary prices by manipulating payment parameters during the Stripe payment flow. The vulnerability exists because the intentForStripe() function passes user-controlled $_POST['amount'] directly to the Stripe PaymentIntent API without validation, and the commitStripe() function ignores the server-calculated amount when confirming payments.

Critical Impact
Attackers can book services at fraudulently low prices (e.g., $0.01 instead of $500.00), causing direct financial loss to site owners using the Booking Package plugin with Stripe payment integration.

Affected Products

Booking Package plugin for WordPress versions up to and including 1.7.06
WordPress sites using Stripe payment integration with vulnerable plugin versions

Discovery Timeline

2026-04-28 - CVE-2026-4911 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-4911

Vulnerability Analysis

This vulnerability represents a classic business logic flaw (CWE-472: External Control of Assumed-Immutable Web Parameter) in payment processing. While the Booking Package plugin correctly calculates booking costs server-side via the getAmount() function—accounting for services, guests, taxes, and coupons—the calculated amount is never enforced during payment processing.

The disconnect occurs because critical validation code in CreditCard.php that would include the calculated amount in the PaymentIntent update is commented out. This architectural oversight allows attackers to exploit the trust boundary between client-side payment data and server-side processing.

Root Cause

The root cause is improper validation of payment amounts in the Stripe integration workflow. Specifically:

The intentForStripe() function in CreditCard.php accepts user-controlled $_POST['amount'] without comparing it to the server-calculated booking price
The commitStripe() function confirms payments without validating that the PaymentIntent amount matches the expected booking cost
Code that would have enforced amount validation appears to be commented out in the source, leaving a gap between price calculation and payment confirmation

This allows the payment flow to complete successfully even when the submitted amount differs drastically from the actual service cost.

Attack Vector

An attacker can exploit this vulnerability through network-based manipulation of the payment flow. The attack requires no authentication and involves intercepting the booking request to modify the amount parameter before it reaches the Stripe PaymentIntent API. Because the server never validates this amount against the calculated booking price, the attacker can submit minimal payments (such as $0.01) for expensive services while the booking is recorded as complete.

The vulnerability is exploitable through simple HTTP parameter manipulation using browser developer tools or proxy tools like Burp Suite. The attacker intercepts the payment request, modifies the amount field to their desired value, and allows the request to proceed normally.

Detection Methods for CVE-2026-4911

Indicators of Compromise

Bookings with payment amounts significantly lower than the calculated service cost
Stripe transaction logs showing inconsistent amounts compared to booking records
Pattern of bookings where payment confirmation succeeds but amounts are minimal (e.g., $0.01)
Unusual POST requests to booking endpoints with manipulated amount parameters

Detection Strategies

Implement server-side logging to compare $_POST['amount'] values against getAmount() calculated prices
Configure Stripe webhook monitoring to alert on payments below expected thresholds
Enable WordPress audit logging to track booking submissions with payment details
Deploy web application firewall (WAF) rules to flag suspicious amount parameters in booking requests

Monitoring Recommendations

Review Stripe Dashboard transaction history for anomalous low-value payments associated with high-value bookings
Monitor WordPress access logs for repeated booking attempts from single IP addresses with varying amounts
Set up alerts for bookings where the recorded payment is below a minimum threshold percentage of the service price
Implement real-time comparison logging between calculated amounts and submitted payment values

How to Mitigate CVE-2026-4911

Immediate Actions Required

Update the Booking Package plugin to version 1.7.07 or later immediately
Review recent bookings for potential fraudulent low-price transactions
Consider temporarily disabling Stripe payments until the update is applied
Audit Stripe transaction records against booking records to identify any exploitation attempts

Patch Information

The vulnerability has been addressed in Booking Package version 1.7.07. The patch implements proper server-side validation of payment amounts before confirming PaymentIntents with Stripe. Details of the changes can be reviewed in the WordPress Plugin Changelog. Additional vulnerability details are available in the Wordfence Vulnerability Report.

Workarounds

Disable Stripe payment integration and use alternative payment methods until the plugin is updated
Implement manual booking verification requiring staff approval before confirming bookings
Add server-side validation logic via a custom WordPress plugin or code snippet that compares submitted amounts to calculated prices
Use a security plugin like Wordfence to monitor for suspicious activity targeting the booking endpoints

bash

# Update Booking Package plugin via WP-CLI
wp plugin update booking-package --version=1.7.07

# Verify the current installed version
wp plugin get booking-package --field=version

# If update fails, deactivate until patched version can be applied
wp plugin deactivate booking-package