CVE-2026-16282CWE-287

CVE-2026-16282

Medium · published August 8, 2026

CVSS v3.1

5.3

EPSS

Percentile

21.9

In the wild

Unconfirmed

What it is

The Appointment Hour Booking WordPress plugin before 1.5.88 does not validate a client-supplied booking price against the server-side configured service price, allowing unauthenticated users to submit an arbitrary final price (including zero or negative) that is stored as the authoritative booking price, corrupting booking and payment records.

The record

Technical detail

CVSS v3.1: 5.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00304 · 21.9th percentile
Weakness: CWE-287 · Improper Authentication
Published: 2026-08-08T11:17Z

References (1)

https://wpscan.com/vulnerability/e87116af-d202-434b-9f47-e61e9c886240/ · [email protected]

EPSS history

Timeline

08 AUG 06:00Z
Appointment Hour Booking < 1.5.88 - Unauthenticated Booking Price Manipulation via tcost Parameter
cvelistv5