EUVD-2026-58839
GHSA-g8cr-48gj-g988
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-reachable with no authentication, complexity, or interaction required; impact is integrity-only as no data is read and availability is unaffected.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to mark arbitrary reservations as paid or completed, cancel legitimate payments, auto-approve reservations, and trigger transactional booking emails by writing attacker-supplied payment status and transaction data directly into the payments table. The auto-approval of reservations is only triggered when the 'enable_psuccess_approval' site option is enabled, but payment status manipulation and email dispatch are exploitable regardless of that setting.
AnalysisAI
Authorization bypass in the wpdevart Booking Calendar, Appointment Booking System plugin for WordPress (all versions through 3.2.36) permits unauthenticated remote attackers to write attacker-controlled payment status and transaction data directly into the plugin's payments database table, bypassing any payment gateway verification. This enables fraudulent marking of reservations as paid or completed, cancellation of legitimate customer payments, and dispatch of transactional booking confirmation emails to arbitrary parties. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required - the CVSS vector confirms PR:N. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N yields a base score of 5.3 (Medium), which accurately captures the low attack complexity and unauthenticated network accessibility but arguably underweights the business impact: fraudulent 'paid' status markings can cause an operator to render services without receiving payment, while cancellation of legitimate transactions directly disrupts revenue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a WordPress site running the Booking Calendar plugin by detecting the wpdevart plugin signature in page source or HTTP responses. The attacker then sends a crafted unauthenticated HTTP POST request targeting the payment status handler, supplying a forged transaction ID and a 'paid' or 'completed' status for a target reservation ID obtained by enumerating booking confirmation pages. … |
| Remediation | No vendor-released patched version has been identified at time of analysis - the highest tagged release documented in the references is 3.2.36, which remains vulnerable. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
A Stored Cross-Site Scripting (XSS) vulnerability exists in the wpdevart Booking Calendar and Appointment Booking System
Unauthenticated attackers can modify or cancel other users' appointments in wpdevart's Booking Calendar, Appointment Boo
Missing authorization in the wpdevart Booking Calendar, Appointment Booking System WordPress plugin (versions through 3.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today