Is CVE-2026-4911 actively exploited?

No active exploitation of CVE-2026-4911 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-4911 be exploited remotely?

Yes. CVE-2026-4911 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-4911?

CVE-2026-4911 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-4911

MEDIUM

CVE-2026-4911

CWE-472Published: April 28, 2026· Updated: Apr 28, 2026

5.3

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:12.6th

Official Description

The Booking Package plugin for WordPress is vulnerable to Price Manipulation in versions up to, and including, 1.7.06 This is due to the intentForStripe() function passing user-controlled $_POST['amount'] directly to the Stripe PaymentIntent API without validation, and the commitStripe() function ignoring the server-calculated amount when confirming the payment. While the server correctly calculates the booking cost via getAmount() based on services, guests, taxes, and coupons, this calculated amount is never validated against or used to update the PaymentIntent because the critical code in CreditCard.php that would include the calculated amount in the PaymentIntent update is commented out. This makes it possible for unauthenticated attackers to book services at arbitrary prices (e.g., $0.01 instead of $500.00) by manipulating the amount parameter during PaymentIntent creation and completing the booking with the fraudulent payment.

NVD Source

Technical Analysis

CVE-2026-4911 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.