CVE-2026-16986 — Booking Package < 1.7.25 - Unauthenticated Price Manipulation via Service and Option Cost Parameters
The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected charge from attacker-…
Published: 2026-08-26 · CVSS: 5.3 · CVSS 3.1
The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected charge from attacker-supplied request values instead, so an unauthenticated attacker can pay an arbitrary fraction of a service's real price.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7