CVE-2026-77704
Low risk· EPSS 3%Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their own bookings that were left awaiting approval and overwriting another customer's booking status on a shared appointment.
Risk Assessment
Customers can manipulate appointment statuses, potentially leading to schedule disruptions, unauthorized approval of bookings, and conflicts between customers.
Recommendation
It is recommended to update the Booking for Appointments and Events Calendar plugin to version 2.4.9 or later, which includes a fix for capability checks.
Other vulnerabilities in Booking for Appointments and Events Calendar
See all- CVE-2026-14216Medium
The Booking for Appointments and Events Calendar WordPress plugin before version 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks.
- CVE-2026-14212Medium
The Booking for Appointments and Events Calendar WordPress plugin before version 9.8 does not verify that an authenticated employee (provider) owns the provider account being updated. This allows any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their account.
- CVE-2026-14213Low
The Booking for Appointments and Events Calendar WordPress plugin before version 2.4.6 does not verify that an authenticated employee (provider) is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data.
- CVE-2026-14214Low
The Booking for Appointments and Events Calendar WordPress plugin before version 2.4.4 does not restrict which fields can be written during customer import. A user with the Amelia Manager role can modify arbitrary columns of any stored user record by supplying them in the import request.
Original NVD description (English source)
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their own bookings that were left awaiting approval and overwriting another customer's booking status on a shared appointment.