CVE-2026-77704

Deferred Deferred - Pending Action

Unauthorized Appointment Status Change in Booking Calendar

Publication date: 2026-08-29

Last updated on: 2026-08-30

Assigner: WPScan

Description

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their own bookings that were left awaiting approval and overwriting another customer's booking status on a shared appointment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-29

Last Modified

2026-08-30

Generated

2026-09-18

AI Q&A

2026-08-29

EPSS Evaluated

2026-09-15

NVD

CVE-2026-77704

EUVD

EUVD-2026-68058

Affected Vendors & Products

Vendor	Product	Version / Range
wp_event_calendar	booking_for_appointments_and_events_calendar	to 2.4.9 (exc)
wpdevart	booking_for_appointments_and_events_calendar	to 2.4.9 (exc)
amelia	amelia	From 1.2.32 (inc) to 2.4.8 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability is a broken access control issue in the Booking for Appointments and Events Calendar WordPress plugin before version 2.4.9. It allows customers to change appointment statuses without proper capability checks, including approving their own pending bookings and overwriting others' statuses on shared appointments.

Detection Guidance

Check if your WordPress site uses the Booking for Appointments and Events Calendar plugin versions 1.2.32 to 2.4.8. Inspect plugin files for the Customer+ Appointment Status Update and Self-Approval feature. Look for unauthorized status changes in appointment logs or database entries.

Impact Analysis

An attacker could exploit this to approve their own bookings that were awaiting approval, potentially gaining unauthorized access or manipulating appointment records. They could also overwrite another customer's booking status on a shared appointment, causing confusion or conflicts in scheduling.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized users to approve or modify appointment statuses without proper authorization. This may lead to unauthorized access to personal data or appointment details, violating data protection requirements.

Mitigation Strategies

Update the Booking for Appointments and Events Calendar plugin to version 2.4.9 or later immediately. Remove or disable the plugin if an update is not possible. Review appointment statuses for unauthorized changes and restrict user permissions to prevent future misuse.

Hi! I’m here to help you understand CVE-2026-77704. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70