{"schemaVersion":3,"id":"CVE-2026-77705","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"The Booking for Appointments and Events Calendar  WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the password and email address of other users' WordPress accounts and take them over.","dates":{"published":"2026-09-12T06:00:07.938Z","modified":"2026-09-12T15:35:37.592Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.2,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.2,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.2,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"wordfence","score":6.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00462,"percentile":0.38617,"severity":"low","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":0.146,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.00316},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00316,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00316,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00316,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00316,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00316,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00316,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00316,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00316,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00316,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00316,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00462,"percentile":0.38617}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.00316,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00316,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00316,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00316,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00316,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00316,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00462,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00462,"percentile":0.38617}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_CA27A22E611096F3","name":"Exploit Reference (wpscan.com)","source":"reference","url":"https://wpscan.com/vulnerability/bfd0ce74-f91e-41fe-8288-7b1d34dd16fe/","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-639","name":"Authorization Bypass Through User-Controlled Key","description":"The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/639.html"},{"id":"CWE-269","name":"Improper Privilege Management","description":"The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/269.html"}],"affected":[{"vendor":"unknown","product":"booking for appointments and events calendar","name":"Booking for Appointments and Events Calendar","label":"booking for appointments and events calendar","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 2.4.10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.10","eol":null,"hubHref":"/vendor/unknown/booking_for_appointments_and_events_calendar"},{"vendor":"wordpress","product":"ameliabooking","name":"Booking for Appointments and Events Calendar – Amelia","label":"ameliabooking","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 2.4.10","noFixRecorded":false,"fixedIn":"2.4.10"}],"versionsText":"< 2.4.10","eol":null,"hubHref":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://wpscan.com/vulnerability/bfd0ce74-f91e-41fe-8288-7b1d34dd16fe/","label":"wpscan.com/vulnerability/bfd0ce74-f91e-41fe-8288-7b1d34dd16fe/","hostname":"wpscan.com","tags":["Exploit","VDB Entry","Technical Description"]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5be9a2f4-f3de-40e4-80ce-b8588e6318bf","label":"www.wordfence.com/threat-intel/vulnerabilities/id/5be9a2f4-f3de-40e4-80ce-b8588e6318bf","hostname":"www.wordfence.com","tags":["Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-09-12T06:00:07.938Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-12T15:35:37.592Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":39,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T12:50:45.667Z","stale":false,"partial":false}}