CVE-2026-76586 Overview
CVE-2026-76586 is a business logic flaw in the Appointment Booking Calendar Plugin and Scheduling Plugin for WordPress before version 1.6.3. The plugin confirms online payments without verifying the amount actually paid against the server-side price staged for a booking. Unauthenticated attackers can approve paid appointments for a fraction of the listed price. The weakness maps to [CWE-284: Improper Access Control].
Critical Impact
Unauthenticated users can obtain fully approved paid appointments while paying arbitrarily small amounts, causing direct revenue loss for site operators.
Affected Products
- Appointment Booking Calendar Plugin and Scheduling Plugin for WordPress
- Versions prior to 1.6.3
- WordPress sites accepting online payments through the plugin
Discovery Timeline
- 2026-08-29 - CVE-2026-76586 published to NVD
- 2026-08-31 - Last updated in NVD database
Technical Details for CVE-2026-76586
Vulnerability Analysis
The plugin implements a booking workflow where a price is calculated and staged server-side when the customer initiates a booking. When the payment provider returns a confirmation, the plugin marks the appointment as paid and approved. The confirmation handler does not compare the payment provider's reported amount against the staged price. An attacker who controls or manipulates the payment amount can trigger approval with any value, including near-zero payments.
This is a business logic error rather than a memory or injection flaw. The integrity impact is high because attackers alter the financial state of bookings. Confidentiality and availability are not affected.
Root Cause
The root cause is missing server-side validation between the authoritative staged price and the confirmed payment amount. The plugin trusts the callback flow to reflect the correct value rather than re-checking it against the booking record before transitioning the appointment to an approved state.
Attack Vector
Exploitation occurs over the network without authentication or user interaction. An attacker initiates a legitimate booking, then completes the payment for an amount lower than the staged price using supported payment flows. When the plugin receives the payment confirmation, it approves the appointment regardless of the underpayment. Technical details are available in the WPScan Vulnerability Report.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-76586
Indicators of Compromise
- Approved appointments in the plugin's database with payment totals below the configured service price.
- Payment provider transaction logs showing successful captures for atypical low amounts tied to booking identifiers.
- Repeated booking initiations from the same IP or session followed by low-value payments and confirmed appointments.
Detection Strategies
- Reconcile booking records against payment provider settlement reports to flag mismatches between staged price and captured amount.
- Alert on appointment approval events where the recorded amount is less than the service catalog price.
- Review WordPress access logs for unauthenticated POSTs to the plugin's payment confirmation endpoint followed by state changes on booking records.
Monitoring Recommendations
- Enable WordPress audit logging for booking status transitions and payment confirmations.
- Ingest web server and payment gateway logs into a centralized SIEM for correlation across booking and payment events.
- Track anomalies in average revenue per booking to identify systemic underpayment abuse.
How to Mitigate CVE-2026-76586
Immediate Actions Required
- Update the Appointment Booking Calendar Plugin and Scheduling Plugin to version 1.6.3 or later on all WordPress sites.
- Audit recent approved appointments against payment gateway records and reverse any underpaid bookings.
- Restrict access to the plugin's payment confirmation endpoints at the web application firewall layer until patching is complete.
Patch Information
Upgrade to version 1.6.3 of the plugin, which addresses the missing server-side price verification. Refer to the WPScan Vulnerability Report for the fixed version reference.
Workarounds
- Temporarily disable online payment options in the plugin and require manual approval of bookings until the patch is applied.
- Configure the payment gateway to reject transactions below a defined minimum equal to the lowest legitimate service price.
- Add a reconciliation step in the booking workflow that verifies captured amount equals the staged price before approval.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
