The Appointment Booking Calendar plugin for WordPress up to version 1.3.96 has a missing authorization vulnerability. An unauthenticated endpoint accepts attacker-supplied payment notifications without verifying their authenticity or requiring authorization. This allows attackers to confirm bookings arbitrarily, causing unauthorized entries in the live calendar and triggering notification emails, which can disrupt normal operations.