EUVD-2026-68053
GHSA-h9qm-hc3c-qpr3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Network-reachable payment endpoint requires no authentication or user interaction; impact is integrity-only as fraudulent bookings are confirmed at attacker-manipulated prices with no confidentiality or availability dimension.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment, allowing unauthenticated users to have a paid appointment approved for a fraction of its price.
AnalysisAI
Payment confirmation bypass in the Appointment Booking Calendar Plugin and Scheduling Plugin for WordPress (versions before 1.6.3) lets unauthenticated users complete paid appointment bookings by submitting only a fraction of the listed price. The plugin stages a server-side price for each booking but fails to validate the amount actually received from the payment processor against that staged figure before confirming the appointment. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The online payment feature of the plugin must be enabled and configured with an active payment gateway - WordPress sites using only offline or manual payment confirmation are not affected by this vulnerability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 High score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) accurately reflects that the attack requires no authentication, no user interaction, is executable over the network, and carries low attack complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Appointment Booking Calendar Plugin and Scheduling Plugin to version 1.6.3 or later, confirmed as the patched release by both EUVD-2026-68053 and the WPScan advisory at https://wpscan.com/vulnerability/bc74bc9b-92ce-434e-a21d-34d7525c8600/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today