WordPress Appointment Hour Booking plugin < 1.5.88 - Unauthenticated Booking Price Manipulation via tcost Parameter vulnerability

Unauthenticated Booking Price Manipulation via tcost Parameter vulnerability discovered by Researcher1: Alessandro Greco aka Aleff; Researcher2: Giovambattista Ianni; Company/Organization: University of Calabria UNICAL in WordPress Plugin Appointment Hour Booking versions 1.5.88...

CVE-2026-16282

The Appointment Hour Booking WordPress plugin versions prior to 1.5.88 is vulnerable to an unauthenticated booking price manipulation vulnerability. The flaw exists because the plugin fails to validate a client-supplied booking price against the server-side configured service price, specifically ...