CVE-2026-76586
Received Received - Intake

Unauthenticated Price Manipulation in Appointment Booking Calendar Plugin

Publication date: 2026-08-29

Last updated on: 2026-08-29

Assigner: WPScan

Description
The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment, allowing unauthenticated users to have a paid appointment approved for a fraction of its price.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-29
Last Modified
2026-08-29
Generated
2026-08-29
AI Q&A
2026-08-29
EPSS Evaluated
N/A
NVD
CVE-2026-76586
EUVD
EUVD-2026-68053

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
wpbooking appointment_booking_calendar_plugin *
wpbooking bookingpress From 1.5.6 (inc) to 1.6.2 (inc)
wpbooking bookingpress 1.6.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Appointment Booking Calendar Plugin and Scheduling Plugin for WordPress. It allows unauthenticated users to exploit a flaw where the plugin does not verify the actual payment amount against the server-side price during online booking confirmations. This means users can pay less than the required price for an appointment.

Detection Guidance

Check if your BookingPress plugin version is between 1.5.6 and 1.6.2. Use WordPress admin panel to inspect the plugin version or run a command like 'wp plugin list' if using WP-CLI to verify installed versions.

Impact Analysis

Unauthenticated attackers can manipulate booking prices, paying a fraction of the actual cost for appointments. This could lead to financial losses for service providers using the affected plugin versions. The vulnerability specifically impacts BookingPress versions 1.5.6 to 1.6.2.

Mitigation Strategies

Update the BookingPress plugin to version 1.6.3 or later immediately to patch the vulnerability. Disable online payments temporarily if an update is not possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76586. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart