CVE-2026-8840 is an authorization bypass vulnerability (CWE-862) in the Booking calendar, Appointment Booking System WordPress plugin versions up to 3.2.36. The plugin fails to properly verify user authorization before allowing actions that modify reservation and payment statuses. Exploitation enables unauthenticated attackers to mark reservations as paid or completed, cancel legitimate payments, auto-approve reservations if the 'enable_psuccess_approval' option is enabled, and send transactional booking emails by writing attacker-controlled payment status and transaction data directly into the payments table. This vulnerability impacts data integrity but does not affect confidentiality or availability.

The vulnerability allows unauthorized modification of booking and payment records, potentially leading to fraudulent reservation status changes, payment cancellations, and unauthorized email notifications. There is no direct impact on data confidentiality or system availability. The integrity of booking and payment data is compromised, which could affect business operations and trustworthiness of the booking system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is currently available. Until a patch is released, users should consider disabling or restricting access to the affected plugin features, especially the 'enable_psuccess_approval' option, to reduce risk. Monitor vendor channels for updates and apply official patches once available.