WordPress Booking Plugin Fails to Validate Payment Amounts

This vulnerability affects the Appointment Booking Calendar Plugin and Scheduling Plugin for WordPress (versions before 1.6.3), allowing unauthenticated attackers to exploit a critical payment validation flaw. When users complete online payments for appointments, the plugin fails to verify that the amount actually paid matches the server-side price for the booking. This means an attacker can manipulate the payment amount, approve a paid appointment for a fraction of its legitimate cost, or potentially for free. Small businesses, service providers, and organizations relying on this plugin for appointment scheduling and payment collection are directly impacted, facing revenue loss and potential fraud at scale.

While this CVE lacks explicit MITRE ATT&CK technique mapping, Casky's Claude-powered analysis would identify this as a business logic vulnerability pattern consistent with T1190 (Exploit Public-Facing Application) and potentially T1078 (Valid Accounts) techniques when attackers bypass authentication requirements. Practitioners using Casky would observe detection patterns focused on payment confirmation anomalies: requests where client-side payment amounts diverge from server-side expectations, missing or inconsistent price validation in API responses, and approval confirmations lacking cryptographic proof-of-payment verification. Extended reasoning capabilities would flag the absence of server-side validation as a foundational weakness, helping security teams understand that this is not merely a coding error but a fundamental architectural gap in the payment confirmation workflow that requires immediate compensating controls or patching.