Atomic Edge analysis of CVE-2026-59532 (metadata-based): This vulnerability allows unauthenticated attackers to manipulate the price of bookings in the Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment plugin for WordPress, versions up to and including 2.7.2. The severity is moderate, with a CVSS score of 5.3. The attack requires no authentication and no user interaction, but only impacts the integrity of the booking price, not confidentiality or availability.
Root Cause: The root cause is an Improper Input Validation issue (CWE-20). The plugin likely fails to validate or sanitize the price parameter submitted during the booking creation or checkout process. This is an inferred conclusion based on the CWE classification and the vulnerability description. Since no source code is available, Atomic Edge research cannot confirm the exact code path. The vulnerability likely resides in a custom AJAX handler or form processing function that accepts a price value from the client and uses it to calculate the booking total without server-side verification. An attacker can exploit this by intercepting the request and submitting a modified price, such as 0, to obtain a free or heavily discounted booking.
Exploitation: The attack vector is network-based, requiring no authentication. An attacker would interact with the plugin’s booking form or AJAX endpoints. The likely target is an AJAX action, such as `booking_and_rental_manager_for_woocommerce_save_booking`, or an endpoint that handles the booking finalization. The attacker would submit a request containing the booking details along with a manipulated price parameter. A realistic payload would involve altering the ‘total_price’ or ‘price’ field to ‘0’ while keeping the rest of the booking data valid. The request may also need to include a valid nonce if the plugin checks for one, but given the vulnerability, it is likely that the nonce check is absent or flawed. The attack can be performed using common tools like cURL or browser developer tools.
Remediation: The fix must validate all price-related inputs on the server-side. The plugin should not trust price data sent from the client. The recommended approach is to recalculate the booking price based on the selected items, their rates, and any applicable discounts or taxes. The plugin should also verify that the user has the appropriate permissions to apply discounts. In addition to fixing the price calculation, the plugin should implement proper nonce checks for all AJAX actions and form submissions to prevent unauthorized requests. Security best practices include using WordPress’s `sanitize_*` functions and validating all data against a strict whitelist of allowed values.
Impact: Successful exploitation allows an attacker to alter the price of a booking. This could result in financial losses for the site owner, as an attacker could book services or items for free or at a reduced cost. The impact is limited to price manipulation; there is no evidence of data exposure or privilege escalation. However, repeated exploitation could lead to significant financial fraud and undermine trust in the online booking system.
