→ برگشت به فید آسیب‌پذیری‌ها CVE-2026-16282 · appointment-hour-booking

آسیب‌پذیری امنیتی در افزونه Appointment Hour Booking – Booking Calendar

The Appointment Hour Booking plugin for WordPress is vulnerable to Price Manipulation in versions up to, and including, 1.5.87. This is due to the extract_appointments function accepting a user-supplied price via the tcost parameter (stored as $fieldpostedcost) and assigning it directly to the booking record, exploitable by unauthenticated users who could also trigger the vulnerable code path by posting bccf_payment_option_paypal=0. This makes it possible for unauthenticated attackers to manipulate the final booking price by submitting an arbitrary cost value, bypassing server-side price enforcement.