CVE-2026-4911 | masaakitanaka Booking Package Plugin up to 1.7.06 on WordPress Stripe PaymentIntent API CreditCard.php intentForStripe Amount external control of assumed-immutable web parameter

A vulnerability was found in masaakitanaka Booking Package Plugin up to 1.7.06 on WordPress and classified as problematic. Affected is the function intentForStripe of the file CreditCard.php of the component Stripe PaymentIntent API. Such manipulation of the argument Amount leads to external control of assumed-immutable web parameter.

This vulnerability is referenced as CVE-2026-4911. It is possible to launch the attack remotely. No exploit is available.