The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before… (CVE-2026-77704)

This vulnerability (CVE-2026-77704) affects the Booking for Appointments and Events Calendar WordPress plugin prior to version 2.4.9. The plugin does not properly check user capabilities before permitting status changes on appointments. As a result, users who should not have permission can alter appointment statuses, potentially approving their own bookings or overwriting others' statuses. This is classified under CWE-863 (Incorrect Authorization). The CVSS v3.1 base score is 2.7, indicating a low severity impact primarily on integrity. There are no known exploits in the wild and no patch links provided in the data.

The vulnerability allows unauthorized users to modify appointment statuses, which can lead to integrity issues such as unauthorized approval of bookings or alteration of other customers' appointment statuses. There is no impact on confidentiality or availability reported. The overall severity is low based on the CVSS score of 2.7.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix link is provided, users should monitor vendor communications for updates. Until a fix is available, restrict user permissions carefully to limit who can change appointment statuses.