Medium severity5.3NVD Advisory· Published Nov 11, 2026

CVE-2026-92408

Description

The WPS Bookings for WooCommerce WordPress plugin before 3.13.1 does not validate a price value taken from user input before using it to set the product price, allowing unauthenticated users to purchase bookable services at a price of their choosing, including zero.

Affected products

WordPress/WPS Bookings for WooCommercellm-fuzzy
Range: < 3.13.1

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/c40ea3c8-2062-4b4e-a3aa-65b47291725e/nvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000