CVE-2026-16282 Appointment Hour Booking < 1.5.88 - Unauthenticated Booking Price Manipulation via tcost Parameter

The Appointment Hour Booking WordPress plugin before 1.5.88 does not validate a client-supplied booking price against the server-side configured service price, allowing unauthenticated users to submit an arbitrary final price including zero or negative that is stored as the authoritative booking...