CVE-2026-76586: unknown appointment booking calendar plugin and scheduling plugin Improper Access Control
Vulnerability summary
CVE-2026-76586 is a high (CVSS 7.5) Improper Access Control vulnerability in unknown appointment booking calendar plugin and scheduling plugin. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 28.2% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 1.6.3.
Timeline
- 29-08-2026PublishedVulnerability first disclosed.
- 30-08-2026Last modifiedVulnerability information updated.
Description
The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment, allowing unauthenticated users to have a paid appointment approved for a fraction of its price.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- wordfenceSource7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LDiffers
EPSS trend
Probability
0.36%
Chance of exploitation in the next 30 days
Percentile
28%
Versus all other CVEs
30-day change
+0.15 pp
From 0.21% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- CWE-602Client-Side Enforcement of Server-Side SecurityThe product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.
Affected systems
Unknown1 product
- appointment booking calendar plugin and scheduling plugin≥ 1.5.6, < 1.6.3
Wordpress1 product
- bookingpress-appointment-booking≥ 1.5.6, ≤ 1.6.2 (fixed in 1.6.3)
2 vendors · 2 products