{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://wordpress.org/plugins","product":"WPS Bookings for WooCommerce","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"3.13.1","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-92408","cwes":["CWE-472"],"description":"The WPS Bookings for WooCommerce WordPress plugin before 3.13.1 does not validate a price value taken from user input before using it to set the product price, allowing unauthenticated users to purchase bookable services at a price of their choosing, including zero.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/c40ea3c8-2062-4b4e-a3aa-65b47291725e/"}],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: WPScan","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"}],"modifiedAt":1794382390080,"publishedAt":1794382390080,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/c40ea3c8-2062-4b4e-a3aa-65b47291725e/"}],"remediation":[],"revision":"6bc715fc436b2db6b015e3f4413712617ee42c2b42c72e3f529a9e878d5365c3","sources":[{"modifiedAt":1794382390080,"name":"CNA: WPScan","retrievedAt":1794384524845,"url":"https://www.cve.org/CVERecord?id=CVE-2026-92408"}],"ssvc":null,"status":"published","title":"WPS Bookings for WooCommerce < 3.13.1 - Unauthenticated Price Manipulation via booking_price","updatedAt":1794384524845}