CVE-2026-16986 Booking Package < 1.7.25 - Unauthenticated Price Manipulation via Service and Option Cost Parameters
Unauthenticated attackers can manipulate service costs to pay arbitrary amounts by bypassing server-side price validation in the Booking Package plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-16986?
CVE-2026-16986 is a medium-severity vulnerability in Unknown Booking Package, published on 26 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected charge from attacker-supplied request values instead, so an unauthenticated attacker can pay an arbitrary fraction of a service's real price.
Weakness: CWE-284
Which versions are affected by CVE-2026-16986?
How do I fix CVE-2026-16986?
No fix has been published for CVE-2026-16986 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-16986 being exploited?
There is no known exploitation of CVE-2026-16986 in the wild and no public exploit code.
Sources
Also known as GHSA-38gw-wfcc-f64g.