CVE-2026-8840 is an authorization bypass vulnerability (CWE-862) in the Booking calendar, Appointment Booking System WordPress plugin. The plugin fails to properly verify user authorization before allowing actions that modify reservation and payment states. Exploitation enables unauthenticated attackers to mark reservations as paid or completed, cancel legitimate payments, auto-approve reservations when the 'enable_psuccess_approval' option is enabled, and send transactional booking emails by writing attacker-controlled payment status and transaction data directly into the payments table. This vulnerability affects all plugin versions up to and including 3.2.36.

The vulnerability allows unauthorized users to alter booking and payment statuses without authentication, potentially disrupting legitimate booking workflows and financial transactions. While it does not impact confidentiality or availability, it can cause integrity issues by allowing attackers to manipulate reservation states and payment records. The auto-approval feature exploitation depends on a specific site option being enabled, but payment status manipulation and email triggers are exploitable regardless of configuration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is currently available. Until a patch is released, users should monitor vendor communications for updates and consider restricting access or disabling the plugin if possible to mitigate risk.