The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a… (CVE-2026-77689)
The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway. This lets an unauthenticated attacker obtain confirmed, fully paid appointments and events without any payment being collected.
AI Analysis
Technical Summary
CVE-2026-77689 affects the Booking for Appointments and Events Calendar WordPress plugin prior to version 9.8.1. The vulnerability arises because the plugin does not verify that a payment was successfully taken before recording a booking as paid. It trusts the payment gateway indicated in a public, unauthenticated booking request, allowing an attacker to bypass payment requirements and obtain confirmed bookings without payment. This issue occurs even if the site has never configured the specified payment gateway.
Potential Impact
An unauthenticated attacker can obtain confirmed, fully paid appointments and events without any payment being collected. This can lead to financial loss and potential disruption of booking services. The vulnerability does not impact confidentiality or availability but impacts the integrity of payment verification.
Mitigation Recommendations
A fix is available in Booking for Appointments and Events Calendar plugin version 9.8.1. Users should upgrade to version 9.8.1 or later to remediate this vulnerability. No other mitigation is indicated in the available data.
The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a… (CVE-2026-77689)
Description
The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway. This lets an unauthenticated attacker obtain confirmed, fully paid appointments and events without any payment being collected.
CVSS v3.1
Score 5.3medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-77689 affects the Booking for Appointments and Events Calendar WordPress plugin prior to version 9.8.1. The vulnerability arises because the plugin does not verify that a payment was successfully taken before recording a booking as paid. It trusts the payment gateway indicated in a public, unauthenticated booking request, allowing an attacker to bypass payment requirements and obtain confirmed bookings without payment. This issue occurs even if the site has never configured the specified payment gateway.
Potential Impact
An unauthenticated attacker can obtain confirmed, fully paid appointments and events without any payment being collected. This can lead to financial loss and potential disruption of booking services. The vulnerability does not impact confidentiality or availability but impacts the integrity of payment verification.
Mitigation Recommendations
A fix is available in Booking for Appointments and Events Calendar plugin version 9.8.1. Users should upgrade to version 9.8.1 or later to remediate this vulnerability. No other mitigation is indicated in the available data.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-mqrq-3vgp-g3ff
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-77689"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa5effa55bf5e2cf5ef6f9c
Added to database: 09/13/2026, 00:36:10 UTC
Last enriched: 09/13/2026, 00:38:00 UTC
Last updated: 09/13/2026, 03:01:23 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.