Security Alert Summary
The Booking for Appointments and Events Calendar WordPress plugin (versions before 9.8.1) does not verify that a payment was actually processed before marking a booking as paid. The plugin trusts a payment gateway identifier provided in a public, unauthenticated booking request, which can allow an unauthenticated attacker to create confirmed, paid bookings without any payment being collected.
CVE Details
- CVE ID: CVE-2026-77689
- Affected component: Booking for Appointments and Events Calendar WordPress plugin
- Affected versions: Versions before 9.8.1 (affected data lists version 9.0 as an example)
- Published: September 12, 2026, 06:16 AM UTC
- Last modified: September 12, 2026, 04:16 PM UTC
- CVSS v3.1: Base score 5.3, MEDIUM —
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Authentication / privileges / user interaction: No authentication required; privileges required: none; user interaction: none
- Primary impact: Integrity: low (unauthorized creation of bookings marked as paid). Confidentiality: none. Availability: none.
- CWE / weakness: CWE-284 (Improper Access Control)
Technical Details
According to the advisory, the plugin records a booking as paid based solely on the payment gateway identifier supplied in a public, unauthenticated booking request. The plugin does not verify that a payment has actually been processed by the expected gateway or that the gateway is configured on the site. Because the request is unauthenticated and public, an attacker can submit a booking request naming a gateway and have the booking recorded as confirmed and paid even when no funds were collected.
No specific functions or REST endpoints are named in the available data; the description highlights a lack of server-side verification of payment state and trust of client-supplied gateway identifiers as the root cause.
Impact is limited to the ability to create confirmed paid bookings without payment. The issue does not, based on the provided data, allow direct disclosure of other data, execution of arbitrary code, or denial of service.
How This Could Impact Your Website
Consider a small appointment-based business using this plugin: a site owner, an internal staff member who manages bookings, and an external contractor who occasionally submits appointments. An attacker could submit booking requests that appear to be paid, resulting in confirmed appointments showing as paid in the admin interface. Staff may treat these bookings as legitimate and reserve resources or provide services without payment.
Practical consequences include exposure to financial loss from uncollected payments and increased risk of targeted phishing or social engineering if attacker-controlled bookings are used to learn staff scheduling patterns. The issue does not inherently disclose sensitive user emails in the reported data, but improper booking records can still create operational confusion and financial exposure.
professional review If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts that can create bookings.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce your attack surface.
- Monitor site activity and booking logs for unusual behavior, such as many paid bookings from the same IP or rapid sequences of bookings that were not paid externally.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
