IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
5.3Mittel

CVE-2026-92408WPS Bookings for WooCommerce < 3.13.1 - Unauthenticated Price Manipulation via booking_price

WPS Bookings for WooCommerce Veröffentlicht: (vor 3 Stunden)

Beschreibung

The WPS Bookings for WooCommerce WordPress plugin before 3.13.1 does not validate a price value taken from user input before using it to set the product price, allowing unauthenticated users to purchase bookable services at a price of their choosing, including zero.

Schwachstellentyp (CWE): CWE-472

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
— WPS Bookings for WooCommerce < 3.13.1

Referenzen und Patches

Neue CVEs im selben Produkt — WordPress plugins & themes

5.3Mittel
CVE-2026-119171

Advanced Product Fields (Product Addons) for WooCommerce 1.6.22 - 1.7.3 - Unauthenticated Paid Option Surcharge Bypass via Add-to-Cart Choice Field

Advanced Product Fields (Product Addons) for WooCommerce

The Advanced Product Fields (Product Addons) for WooCommerce WordPress plugin from 1.6.22 to 1.7.3 does not validate that a submitted value for a required paid product option matches one of the configured choices, only that it is not empty, allowing unauthent…