CVE-2026-92408
WPS Bookings for WooCommerce < 3.13.1 - Unauthenticated Price Manipulation via booking_price
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
The WPS Bookings for WooCommerce WordPress plugin before 3.13.1 does not validate a price value taken from user input before using it to set the product price, allowing unauthenticated users to purchase bookable services at a price of their choosing, including zero.
| Vendor | unknown |
| Product | wps bookings for woocommerce |
| Published | Nov 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown wps bookings for woocommerce
Be the first to know when new medium vulnerabilities affecting unknown wps bookings for woocommerce are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Unknown / WPS Bookings for WooCommerce
0 < 3.13.1
References
Credits
Profon3 WPScan