Appointment Booking Calendar CVE-2026-76586

The online payment feature of the plugin must be enabled and configured with an active payment gateway - WordPress sites using only offline or manual payment confirmation are not affected by this vulnerability. No authentication is required; exploitation is executable by any anonymous user who can reach the booking form. Exploitation is further limited to plugin versions prior to 1.6.3 on WordPress installations. The attacker must be able to complete the payment initiation flow, which implies the booking form is publicly accessible.

The CVSS 7.5 High score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) accurately reflects that the attack requires no authentication, no user interaction, is executable over the network, and carries low attack complexity. However, the EPSS of 0.14% at the 3rd percentile sharply diverges from the CVSS severity - despite a publicly available WPScan PoC, mass automated exploitation has not materialized at the time of analysis. The absence from CISA KEV corroborates this. Real-world risk is primarily financial fraud against service operators: any business relying on this plugin for paid bookings faces direct revenue loss and potentially a large volume of fraudulently confirmed appointments that must be manually reviewed. SSVC signals suggest exploitation is technically straightforward (automatable given the PoC) but impact scope is bounded to the specific plugin's payment flow rather than full system compromise. No confidentiality or availability dimension is present. The low EPSS despite PoC availability may reflect limited scanner visibility or the niche plugin footprint rather than confirmed absence of abuse.

An attacker navigates to a WordPress site running the vulnerable plugin, selects a paid appointment slot, and during the payment step manipulates the transaction amount - for example, submitting $0.01 for a $150 consultation. Because the server does not validate the paid amount against the staged price before confirming, the booking is approved at the fraudulent amount. A publicly available PoC via WPScan demonstrates this flow and requires only a browser or HTTP client with no prior account or privileges.