CVE-2026-4911 is a medium-severity vulnerability in the masaakitanaka Booking Package WordPress plugin affecting versions up to 1.7.06. The vulnerability arises from the intentForStripe() function passing the user-controlled $_POST['amount'] directly to the Stripe PaymentIntent API without validation, while the commitStripe() function ignores the server-calculated amount when confirming payments. Although the server correctly computes the booking cost via getAmount(), this value is not used to update or validate the PaymentIntent due to commented-out code in CreditCard.php. This flaw enables unauthenticated attackers to manipulate the payment amount parameter and complete bookings at arbitrary prices.

The vulnerability allows attackers to bypass the legitimate booking cost calculation and pay arbitrary amounts for services, potentially resulting in financial loss to the service provider. There is no impact on confidentiality or availability reported. Exploitation does not require authentication or user interaction.

Patch status is not yet confirmed — no official fix or vendor advisory is currently available. Users of the Booking Package plugin should monitor the vendor's communications for updates and apply any forthcoming patches promptly. Until a fix is released, consider disabling the plugin or restricting access to payment processing endpoints to trusted users if feasible.