CyberRota Analysis
AI-GeneratedThe Booking Package plugin for WordPress versions prior to 1.7.25 is vulnerable due to insufficient server-side validation of payment amounts, allowing unauthenticated attackers to manipulate request values and pay less than the actual service price. This flaw can lead to financial losses for businesses relying on the plugin for transactions. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this risk.
Original NVD Description
The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected charge from attacker-supplied request values instead, so an unauthenticated attacker can pay an arbitrary fraction of a service's real price.