CVE-2026-77689

Name of the Vulnerable Software and Affected Versions Booking for Appointments and Events Calendar versions prior to 9.8.1

Description The plugin fails to verify if a payment was successfully processed before marking a booking as paid. It trusts the payment gateway specified in a public, unauthenticated booking request, even if that gateway has not been configured on the site. This allows an unauthenticated attacker to secure confirmed and fully paid appointments or events without making any payment.

Recommendations Update to version 9.8.1 or later.