Threat database

The Booking Package WordPress plugin up to version 1.7.29 is affected by a stored cross-site scripting (XSS) vulnerability via the 'id' parameter. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping.

The Booking Package plugin for WordPress up to version 1.7.29 has an authorization bypass vulnerability. This flaw allows unauthenticated attackers to access personally identifiable information of all booked customers, including names, emails, phone numbers, addresses, and cancellation tokens. The vulnerability arises because the plugin fails to properly verify user authorization. The nonce intended to protect the endpoint is a public CSRF token exposed on pages using the booking_package shortcode or widget, making it easily accessible to attackers.

The Booking Package plugin for WordPress is vulnerable to generic SQL Injection via 'email' Form Parameter (form<N>) in all versions up to, and including, 1.7.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable REST API endpoint /wp-json/booking-package/v1/request is registered with permission_callback: __return_true and wp_magic_quotes does not apply to REST-sourced $_POST values, meaning single quotes in the payload reach the SQL sink intact without any authentication requirement. The impact of this is severely limited as the vulnerable parameter goes through is_email.

The Booking Package plugin for WordPress has a vulnerability in versions up to and including 1.7.16 that allows privilege escalation via account takeover. This occurs because the 'updateUser' AJAX endpoint lacks proper capability checks, enabling authenticated users with Editor-level access or higher to change the email and password of any account, including administrators. This can lead to a full site takeover.

The Booking Package plugin for WordPress up to version 1.7.06 contains a vulnerability allowing unauthenticated attackers to manipulate booking prices by altering the amount parameter sent to the Stripe PaymentIntent API. The plugin fails to validate or enforce the server-calculated booking cost during payment confirmation, enabling attackers to pay arbitrary amounts, potentially much lower than the actual service cost. This issue arises because the critical code that would update the PaymentIntent with the correct amount is commented out. The vulnerability is classified under CWE-472 (External Control of Assumed-Immutable Web Parameter) and has a CVSS score of 5.3, indicating medium severity. No official patch or remediation guidance is currently available from the vendor.

The Booking Package plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the locale parameter in all versions up to, and including, 1.6.72 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.