CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to have their bookings marked as fully paid without any payment reaching the site owner.
Explanation of Vulnerability in Simple Terms
WP Hotel Booking versions before 2.3.2 contain an integrity vulnerability allowing network-based modification of data without authentication. An attacker can alter information on the site by sending specially crafted requests. No user interaction or elevated privileges are required. Update to version 2.3.2 or later to resolve this issue.
What an attacker can do
Modify data on the site via network requests without needing to log in.
Potential impact on your site
Attackers can alter booking data, settings, or other site content without authorization.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
