CVE-2026-77689
UnknownSummary
The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway. This lets an unauthenticated attacker obtain confirmed, fully paid appointments and events without any payment being collected.
Risk Assessment
An attacker can create confirmed, paid-marked bookings without authentication and without making any payment. This causes financial losses and occupies slots belonging to paying customers.
Recommendation
Update the Booking for Appointments and Events Calendar plugin to version 9.8.1 or later. Verify existing bookings marked as paid against actual payments.
Other vulnerabilities in Booking for Appointments and Events Calendar WordPress plugin
See all- CVE-2026-77705Unknown
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the password and email address of other users' WordPress accounts and take them over.
- CVE-2026-14211Low
The Booking for Appointments and Events Calendar WordPress plugin before version 9.7 does not verify that an authenticated employee (provider) is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any customer by enumerating sequential identifiers.
Original NVD description (English source)
The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway. This lets an unauthenticated attacker obtain confirmed, fully paid appointments and events without any payment being collected.