{"id":"CVE-2026-92408","kind":"vulnerability","aliases":["CVE-2026-92408"],"related":[],"title":"WPS Bookings for WooCommerce: unvalidated price lets buyers pay any amount","description":"The WPS Bookings for WooCommerce WordPress plugin before 3.13.1 does not validate a price value taken from user input before using it to set the product price, allowing unauthenticated users to purchase bookable services at a price of their choosing, including zero.","summary":"The WPS Bookings for WooCommerce WordPress plugin takes a price value from user input without checking it. An unauthenticated visitor can book a service at a price of their choosing, including zero.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","woocommerce","wordpress","wps-bookings"],"not_affected_if":["plugin-not-installed","version-3.13.1-or-later"],"how_to_check":"- Check the installed version of the WPS Bookings for WooCommerce plugin in the WordPress admin under Plugins; versions below `3.13.1` are listed as affected.\n- Look for the plugin in the WordPress plugin directory at `wp-content/plugins/` and read its version header.","fix":"- WPS Bookings for WooCommerce: move to `3.13.1` or later.","status":"open","published_at":"2026-11-11T08:17:18+00:00","first_seen_at":"2026-11-11T08:26:05+00:00","triaged_at":"2026-11-11T08:27:58+00:00","updated_at":"2026-11-11T08:27:58+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T08:27:58Z","model":"claude-haiku-5-5","output":{"fix":"- WPS Bookings for WooCommerce: move to `3.13.1` or later.","reach":"internet","title":"WPS Bookings for WooCommerce: unvalidated price lets buyers pay any amount","impact":"low","summary":"The WPS Bookings for WooCommerce WordPress plugin takes a price value from user input without checking it. An unauthenticated visitor can book a service at a price of their choosing, including zero.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","wps-bookings"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attackers buy bookable services for any price, including zero.","analyst_note":"","how_to_check":"- Check the installed version of the WPS Bookings for WooCommerce plugin in the WordPress admin under Plugins; versions below `3.13.1` are listed as affected.\n- Look for the plugin in the WordPress plugin directory at `wp-content/plugins/` and read its version header.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-3.13.1-or-later"],"who_is_affected":"Sites running the WPS Bookings for WooCommerce WordPress plugin before 3.13.1 that sell bookable services through WooCommerce. The flaw lets an unauthenticated visitor set the booking price, so any such site accepting bookings is exposed. Sites without this plugin can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000731,"input_tokens":4540,"output_tokens":553,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-92408':14A,17A '3.13.1':64C 'allow':83C 'amount':11A 'book':2A,23B,26B,45B,58C 'bookabl':88C 'buyer':8A 'check':39B 'choos':53B,95C 'cve':12A,15A 'includ':54B,96C 'input':37B,74C 'let':7A 'packag':18B 'pay':9A 'plugin':30B,62C 'price':6A,33B,50B,69C,82C,92C 'product':81C 'purchas':87C 'servic':47B,89C 'set':79C 'take':31B 'taken':71C 'unauthent':42B,84C 'unvalid':5A 'use':76C 'user':36B,73C,85C 'valid':67C 'valu':34B,70C 'visitor':43B 'without':38B 'woocommerc':4A,19B,28B,60C 'wordpress':20B,29B,61C 'wps':1A,22B,25B,57C 'wps-book':21B 'zero':55B,97C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WPS Bookings for WooCommerce WordPress plugin before 3.13.1 that sell bookable services through WooCommerce. The flaw lets an unauthenticated visitor set the booking price, so any such site accepting bookings is exposed. Sites without this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","woocommerce","wordpress","wpsbookings"],"campaign_type":null,"search_a":"'-2026':13A,16A '-92408':14A,17A 'amount':11A 'book':2A 'buyer':8A 'cve':12A,15A 'let':7A 'pay':9A 'price':6A 'unvalid':5A 'woocommerc':4A 'wps':1A","search_b":"'book':23B,26B,45B 'check':39B 'choos':53B 'includ':54B 'input':37B 'packag':18B 'plugin':30B 'price':33B,50B 'servic':47B 'take':31B 'unauthent':42B 'user':36B 'valu':34B 'visitor':43B 'without':38B 'woocommerc':19B,28B 'wordpress':20B,29B 'wps':22B,25B 'wps-book':21B 'zero':55B","search_c":"'3.13.1':64C 'allow':83C 'book':58C 'bookabl':88C 'choos':95C 'includ':96C 'input':74C 'plugin':62C 'price':69C,82C,92C 'product':81C 'purchas':87C 'servic':89C 'set':79C 'taken':71C 'unauthent':84C 'use':76C 'user':73C,85C 'valid':67C 'valu':70C 'woocommerc':60C 'wordpress':61C 'wps':57C 'zero':97C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T08:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92408","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92408","severity":null,"published_at":"2026-11-11T08:17:18+00:00","modified_at":"2026-11-11T08:17:18+00:00","first_seen_at":"2026-11-11T08:26:05+00:00","fetched_at":"2026-11-11T08:26:05+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}