CVE-2026-77689: unknown booking for appointments and events calendar Improper Access Control
Vulnerability summary
CVE-2026-77689 is a medium (CVSS 5.3) Improper Access Control vulnerability in unknown booking for appointments and events calendar. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.6% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 9.8.1.
Timeline
- 12-09-2026PublishedVulnerability first disclosed.
- 12-09-2026Last modifiedVulnerability information updated.
Description
The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway. This lets an unauthenticated attacker obtain confirmed, fully paid appointments and events without any payment being collected.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- wordfenceSource5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.30%
Chance of exploitation in the next 30 days
Percentile
22%
Versus all other CVEs
30-day change
+0.08 pp
From 0.22% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- CWE-602Client-Side Enforcement of Server-Side SecurityThe product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.
Affected systems
Unknown1 product
- booking for appointments and events calendar≥ 9.0, < 9.8.1
Wordpress1 product
- ameliabooking≥ 9.0, ≤ 9.8.0 (fixed in 9.8.1)
2 vendors · 2 products