Paid order without booking record when customer switches listings mid-session (cart/booking desync)

Bug Reports
, ,
1

Hi all,

We run a booking marketplace with HivePress + Bookings + Marketplace (WooCommerce checkout). We traced a payment-integrity issue from server access logs and can describe the exact mechanism. It is reliably reproducible.

Environment: HivePress core 1.7.23, Bookings 1.5.5, Marketplace, WooCommerce 11.x. Before reporting we’d like to ask: has anything in this area changed in core 1.7.24-1.7.31 or recent Bookings/Marketplace releases?

The mechanism:

  1. Customer opens listing A, completes the booking form (date/time/details). A booking post (draft) is created and they land on WooCommerce checkout. Cart contains listing A’s product, and the order will be linked to booking A on completion. So far correct.

  2. Customer does not pay yet. In another tab (or via Back navigation) they keep browsing and press “Book now” on listing B. This fires POST /wp-json/hivepress/v1/listings/{B}/buy/, which immediately replaces the cart product with listing B’s product.

  3. The buy response should redirect the customer into the make-booking flow for B, where the booking post would be created at the details step. On mobile, a tab switch can prevent that redirect from executing, so no booking post for B is ever created. (We observed this on Android Chrome; we’ve also seen mobile Safari kill post-AJAX redirects in other flows.)

  4. Customer returns to the still-open checkout tab from step 1 and submits payment. wc-ajax=checkout processes the current cart contents: listing B’s product, with no booking reference on the cart/order item.

Result: a paid, processing WooCommerce order for listing B with vendor context resolved, but no hp_booking item meta and no booking post at all. The vendor never sees a booking, the customer’s account bookings page is empty despite successful payment, and no availability is blocked. The booking draft for listing A remains orphaned as a draft.

Repro steps (staging):

  1. Listing A: fill booking form → reach checkout, do not pay

  2. New tab: listing B → press Book now → do not proceed further (close tab / navigate away before the redirect completes)

  3. Return to the original checkout tab → pay

  4. Inspect the order: item is listing B’s product, no booking meta; no hp_booking post exists for listing B

The two design questions this raises:

  • The buy endpoint mutates the cart immediately, while the booking post is only created later at the details step - the two are not transactionally linked, so any interruption in between leaves a “armed” cart without booking context

  • Checkout does not validate that a bookable product in the cart carries a booking reference, so such a cart is happily charged

Suggested direction (either would close it): create the booking draft at the buy step so cart and booking always travel together, or add a checkout validation that blocks payment for bookable products with no booking reference.

We currently mitigate with a custom checkout guard, but this seems worth fixing upstream. Happy to provide sanitized log excerpts of the sequence if useful.

Thanks!

Ivan

1 Like
4

Hi,

Thanks for reporting this.

In this case, WooCommerce should ideally prevent the checkout from being completed in the first tab, since the cart has already been changed. However, it seems that there is no such dependency on the cart, and the checkout can still be completed.

We’ll add at least an additional check to prevent such orders from being created without a valid reference.

1 Like