CVE-2026-8840

Name of the Vulnerable Software and Affected Versions Booking calendar, Appointment Booking System versions prior to 3.2.37

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can write arbitrary payment status and transaction data into the payments table via the wpdevart payment AJAX action. This allows attackers to mark reservations as paid or completed, cancel legitimate payments, and trigger transactional booking emails. Additionally, if the enable psuccess approval site option is enabled, attackers can auto-approve reservations.

Recommendations Update the plugin to a version newer than 3.2.36.