CVE-2026-77704 Overview
CVE-2026-77704 is a broken access control vulnerability in the Booking for Appointments and Events Calendar WordPress plugin before version 2.4.9. The plugin fails to verify that a user holds the required capability before allowing them to change an appointment's status. Authenticated customers can set arbitrary statuses on appointments they are booked on. This includes approving their own bookings left awaiting approval and overwriting the booking status of another customer on a shared appointment. The flaw maps to CWE-863: Incorrect Authorization.
Critical Impact
Authenticated customers can approve their own pending bookings and overwrite another customer's booking status on shared appointments, undermining the booking workflow's integrity.
Affected Products
- Booking for Appointments and Events Calendar WordPress plugin versions prior to 2.4.9
- WordPress sites running the vulnerable plugin with customer-level accounts enabled
- Any deployment relying on the plugin's approval workflow for shared appointments
Discovery Timeline
- 2026-08-29 - CVE-2026-77704 published to NVD
- 2026-08-31 - Last updated in NVD database
Technical Details for CVE-2026-77704
Vulnerability Analysis
The plugin exposes a status-change action for appointments to authenticated users. The handler processes status updates without verifying that the calling user has the WordPress capability required to administer bookings. A customer role user can invoke the endpoint and submit an arbitrary status value against their own appointment or against a shared appointment where multiple customers are booked.
Because authorization is not enforced at the handler layer, the plugin accepts requests that should be rejected. Customers can therefore self-approve bookings that were placed into a pending state by the site owner. On appointments shared between customers, one participant can overwrite the status set by another participant, corrupting the workflow that businesses use to manage scheduling.
Root Cause
The root cause is a missing capability check ([CWE-863]) in the appointment status update flow. The plugin authenticates the request but does not authorize the action, treating any logged-in user with a booking reference as entitled to mutate that booking's status field.
Attack Vector
Exploitation requires a valid authenticated session as a customer with at least one booking. The attacker sends a crafted request to the plugin's status change endpoint, specifying the target appointment identifier and the desired status. No user interaction from an administrator or victim customer is required. The attack is network-reachable over standard HTTP or HTTPS to the WordPress site.
No verified exploit code is publicly available. See the WPScan Vulnerability Report for the disclosure details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-77704
Indicators of Compromise
- Appointment records transitioning from pending or awaiting approval to approved without an administrator action in the audit log.
- Booking status changes on shared appointments performed by non-administrative user accounts.
- Unexpected HTTP POST requests to the plugin's status update endpoint originating from customer-role sessions.
Detection Strategies
- Review the WordPress database wp_posts and plugin-specific booking tables for status changes correlated with non-privileged user IDs.
- Enable WordPress action logging and alert on booking status transitions triggered by users lacking the manage_options or plugin-defined booking management capability.
- Correlate access logs with booking status timestamps to identify anomalous self-approval patterns.
Monitoring Recommendations
- Monitor plugin version inventory across managed WordPress sites and flag installations below 2.4.9.
- Track HTTP request patterns to admin-ajax and REST endpoints exposed by the plugin, especially requests carrying status parameters from low-privilege users.
- Alert on rapid sequences of booking status changes performed by the same authenticated customer session.
How to Mitigate CVE-2026-77704
Immediate Actions Required
- Update the Booking for Appointments and Events Calendar WordPress plugin to version 2.4.9 or later.
- Audit recent booking status changes for unauthorized approvals and restore correct states.
- Restrict customer account registration on affected sites until patching is complete.
Patch Information
The vendor addressed the missing capability check in plugin version 2.4.9. Site administrators should apply the update through the WordPress plugin manager or by replacing the plugin files from the official source. Confirm the installed version after the update and review the WPScan Vulnerability Report for confirmation of the fixed release.
Workarounds
- Temporarily disable the plugin if immediate patching is not possible and bookings can be paused.
- Restrict access to the plugin's status update endpoint using a web application firewall rule that blocks non-administrator requests.
- Downgrade authenticated customer accounts to subscriber-only roles that lack booking references until the update is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
