CVE-2026-4911 affects the Booking Package WordPress plugin by allowing price manipulation through external control of the 'amount' parameter in the Stripe PaymentIntent API calls. The intentForStripe() function passes the user-controlled $_POST['amount'] directly without validation, and the commitStripe() function does not verify the server-calculated amount when confirming payments. Although the server calculates the correct booking cost via getAmount(), this value is not enforced because the code responsible for updating the PaymentIntent with the correct amount is commented out in CreditCard.php. This flaw permits unauthenticated attackers to complete bookings at arbitrary prices, bypassing intended payment amounts.

The vulnerability allows attackers to pay less than the legitimate booking cost by manipulating the payment amount parameter, leading to financial loss for the service provider. There is no impact on confidentiality or availability reported. The integrity of payment transactions is compromised due to the acceptance of fraudulent payment amounts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the affected plugin or implementing custom validation to enforce server-calculated amounts before initiating Stripe PaymentIntents. Monitoring for suspicious booking activity may help detect exploitation attempts.