CVE-2026-105992 in Ettrick Escape Room Booking Plugin
Summary
by MITRE • 10/22/2026
The Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not verify a booking's payment status against the payment provider before marking it paid and confirmed, allowing unauthenticated attackers to mark bookings as paid without paying.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in versions of the Ettrick Escape Room Booking WordPress plugin prior to version 1.3.1 represents a critical failure in business logic validation within an e-commerce context. This flaw stems from the application's inability to properly synchronize state between external payment gateways and its internal database records. Specifically, when a user initiates a booking process, the system is designed to transition the reservation status to paid or confirmed only after receiving explicit confirmation of successful transaction completion from the third-party payment provider. However, due to insufficient verification mechanisms, the plugin allows this status update to occur without validating that the financial transaction has actually been settled by the external service. This architectural oversight creates a direct path for exploitation where the integrity of the booking system is compromised at its core operational level.
From a technical perspective, this issue classifies as CWE-862 Missing Authorization and CWE-352 Cross-Site Request Forgery depending on the specific vector used to trigger the state change, though it primarily aligns with CWE-913 Improper Control of Dynamically-Managed Resources in terms of business logic. The attacker does not need valid credentials or authentication tokens to exploit this flaw because the vulnerability resides in the server-side handling of booking status updates rather than access control lists. By manipulating HTTP requests sent during the checkout flow, an unauthenticated actor can force the application to mark a reservation as paid and confirmed without initiating any actual payment transaction through the integrated gateway. This bypasses the fundamental security assumption that financial confirmation is required before resource allocation occurs within the system.
The operational impact of this vulnerability is severe for businesses relying on escape room or similar time-based service bookings. Since resources such as rooms, staff availability, and equipment are reserved upon confirmation, an attacker can secure these assets without incurring any cost. This leads to direct financial loss through missed revenue opportunities and potential logistical disruptions if the business allocates personnel based on false confirmations. Furthermore, this flaw undermines customer trust by allowing malicious actors to monopolize limited inventory, potentially preventing legitimate customers from booking slots during peak times. The lack of payment verification also complicates audit trails and accounting processes, as financial records will not match operational reservations, creating discrepancies that are difficult to reconcile without manual intervention.
Mitigation strategies must focus on implementing robust server-side validation for all state transitions related to financial transactions. Developers should ensure that the application strictly verifies the return payload or webhook from the payment provider before updating the booking status in the database. It is essential to implement idempotency checks and verify transaction IDs against the external gateway's API responses rather than relying on client-supplied data alone. Upgrading to version 1.3.1 of the plugin resolves this issue by correcting these validation procedures. In addition to patching, organizations should consider implementing additional layers of defense such as rate limiting on booking endpoints and monitoring for anomalous patterns in reservation confirmations that do not correspond with payment gateway logs. Aligning future development practices with OWASP guidelines for business logic vulnerabilities will help prevent similar issues where trust is placed in unverified external inputs or client-side assertions regarding financial status.