CVE-2026-77704: CWE-863 Incorrect Authorization in Booking for Appointments and Events Calendar
Description
CVE-2026-77704 is a low-severity authorization vulnerability in the Booking for Appointments and Events Calendar WordPress plugin before version 2.4.9. It allows users with certain privileges to change the status of appointments without proper capability checks, enabling them to approve their own bookings or alter other customers' booking statuses on shared appointments.
CVSS v3.1
Score 2.7low
Affected software
Booking for Appointments and Events Calendar
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Booking for Appointments and Events Calendar WordPress plugin versions before 2.4.9 do not verify that a user has the required capability before allowing changes to an appointment's status. This flaw permits customers to set arbitrary statuses on appointments they are booked on, including approving their own bookings that were awaiting approval and overwriting another customer's booking status on shared appointments. The vulnerability is categorized as CWE-863 (Incorrect Authorization).
Potential Impact
An attacker with the ability to modify appointment statuses can approve their own bookings without proper authorization and change the status of other customers' bookings on shared appointments. This could lead to unauthorized appointment approvals and potential confusion or disruption in appointment management. There is no impact on confidentiality or availability, and the overall severity is low.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user capabilities to prevent unauthorized status changes on appointments. Monitor for updates from the plugin vendor regarding an official fix.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-08-21T08:04:45.568Z
- State
- PUBLISHED
Threat ID: 6a927ab6acd9273b496bdec8
Added to database: 08/29/2026, 06:22:46 UTC
Last enriched: 09/09/2026, 21:53:39 UTC
Last updated: 10/13/2026, 18:48:23 UTC
Views: 65
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.