CVE-2026-77689: WordPress Booking Plugin Auth Bypass Flaw

CVE-2026-77689 Overview

CVE-2026-77689 is a broken access control vulnerability in the Booking for Appointments and Events Calendar WordPress plugin versions prior to 9.8.1. The plugin fails to verify that a payment was actually completed before marking a booking as paid. Instead, it trusts the payment gateway identifier submitted in a public, unauthenticated booking request, even when the site has never configured that gateway. An unauthenticated attacker can obtain confirmed, fully paid appointments and events without any funds being collected. The flaw is tracked under CWE-284 (Improper Access Control).

Critical Impact
Unauthenticated attackers can create confirmed bookings marked as paid without submitting payment, resulting in service theft and revenue loss for site operators.

Affected Products

Booking for Appointments and Events Calendar WordPress plugin, all versions before 9.8.1
WordPress sites using the plugin regardless of which payment gateway is configured
Sites that have never configured a payment gateway remain exploitable

Discovery Timeline

2026-09-12 - CVE-2026-77689 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-77689

Vulnerability Analysis

The plugin exposes a public booking endpoint that accepts a payment gateway name as part of the request body. When processing the request, the server-side code marks the booking as paid based solely on the gateway identifier provided by the client. No callback verification, transaction lookup, or gateway-side confirmation is performed. Attackers submit crafted booking requests that name any gateway string, and the plugin records the booking as confirmed and paid. Because the endpoint accepts anonymous requests, exploitation requires no account, no session, and no user interaction. See the WPScan Vulnerability Report for the researcher writeup.

Root Cause

The root cause is missing server-side validation of payment state. The plugin conflates a client-supplied gateway label with proof of settled payment. Trust is placed on unauthenticated request data rather than on a signed webhook, transaction ID lookup, or a server-initiated capture confirmation against the gateway API. This is a business logic failure classified under CWE-284.

Attack Vector

Exploitation is remote and unauthenticated over the network. An attacker sends an HTTP POST to the plugin's public booking submission endpoint with valid booking fields and a payment_method (or equivalent) parameter naming any gateway. The plugin persists the booking with a paid status and typically issues a confirmation email. No credentials, cookies, or CSRF tokens obtained through prior authentication are required.

No verified proof-of-concept exploit code has been published. Refer to the WPScan advisory for coordinated technical details.

Detection Methods for CVE-2026-77689

Indicators of Compromise

Bookings marked as paid in the plugin database with no corresponding transaction record at the configured payment gateway
Confirmed bookings referencing payment gateways that were never enabled or configured on the site
Unusual spikes in successful booking submissions from a small number of source IP addresses

Detection Strategies

Reconcile bookings recorded as paid against transaction reports exported directly from each payment gateway account
Review WordPress access logs for POST requests to booking submission endpoints containing unexpected payment_method values
Alert on bookings created without a matching gateway webhook event or transaction identifier

Monitoring Recommendations

Enable verbose logging on the plugin and web server, capturing request bodies for booking endpoints
Monitor for booking creation events outside normal business hours or from anonymized infrastructure
Configure daily reconciliation reports comparing plugin booking totals to gateway settlement totals

How to Mitigate CVE-2026-77689

Immediate Actions Required

Update the Booking for Appointments and Events Calendar plugin to version 9.8.1 or later
Audit all bookings created before the patch was applied and cross-reference against payment gateway transaction records
Cancel or manually verify any bookings that cannot be matched to a real gateway transaction

Patch Information

The vendor addressed CVE-2026-77689 in version 9.8.1 of the plugin. The fix requires server-side verification that a payment was actually settled by the named gateway before a booking is recorded as paid. Site administrators should upgrade through the WordPress plugin dashboard or via WP-CLI. Consult the WPScan Vulnerability Report for advisory details.

Workarounds

Temporarily disable the plugin on sites where upgrading is not immediately possible
Restrict access to booking endpoints using a web application firewall rule until the patch is applied
Manually approve all incoming bookings and require operator confirmation of payment before honoring appointments

bash

# Update the plugin using WP-CLI
wp plugin update booking-for-appointments-and-events-calendar --version=9.8.1

# Verify installed version
wp plugin get booking-for-appointments-and-events-calendar --field=version