Description
The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to mark arbitrary reservations as paid or completed, cancel legitimate payments, auto-approve reservations, and trigger transactional booking emails by writing attacker-supplied payment status and transaction data directly into the payments table. The auto-approval of reservations is only triggered when the 'enable_psuccess_approval' site option is enabled, but payment status manipulation and email dispatch are exploitable regardless of that setting.
Published: 2026-08-15
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The plugin’s wpdevart_payment AJAX handler fails to confirm that the requestor has permission to act on reservation data. As a result any user who can reach the site can alter payment status, mark reservations completed or cancelled, and force email notifications by writing arbitrary values into the payments table. This fault compromises the integrity of the booking system, may lead to fraudulent invoicing, and disrupts normal business operations.

Affected Systems

The vulnerability affects all installations of the WPDevArt "Booking calendar, Appointment Booking System" plugin version 3.2.36 and earlier on WordPress sites.

Risk and Exploitability

With a CVSS score of 5.3 the flaw is considered moderate. EPSS is not available and the issue is not currently listed in the CISA KEV catalog, but the lack of authentication in the AJAX endpoint means that an attacker only needs unauthenticated access to the website to perform the exploit. The attack can be carried out through simple HTTP POST requests to the wpdevart_payment action without any additional credentials.

Generated by OpenCVE AI on August 15, 2026 at 03:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Booking calendar, Appointment Booking System plugin to the latest version that implements proper authorization checks for the wpdevart_payment endpoint.
  • If an upgrade is not immediately possible, disable or remove the wpdevart_payment AJAX action to prevent unauthenticated access to payment data.
  • Ensure that the "enable_psuccess_approval" site option is only enabled for trusted environments and that transactional emails are triggered only after a verified payment confirmation logic is in place.

Generated by OpenCVE AI on August 15, 2026 at 03:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 15 Aug 2026 03:45:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Wpdevart
Wpdevart booking Calendar, Appointment Booking System
Vendors & Products Wordpress
Wordpress wordpress
Wpdevart
Wpdevart booking Calendar, Appointment Booking System

Sat, 15 Aug 2026 02:45:00 +0000

Type Values Removed Values Added
Description The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to mark arbitrary reservations as paid or completed, cancel legitimate payments, auto-approve reservations, and trigger transactional booking emails by writing attacker-supplied payment status and transaction data directly into the payments table. The auto-approval of reservations is only triggered when the 'enable_psuccess_approval' site option is enabled, but payment status manipulation and email dispatch are exploitable regardless of that setting.
Title Booking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

Wordpress Wordpress
Wpdevart Booking Calendar, Appointment Booking System
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-08-15T02:26:16.822Z

Reserved: 2026-05-18T15:21:05.364Z

Link: CVE-2026-8840

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T03:16:48.357

Modified: 2026-08-15T03:16:48.357

Link: CVE-2026-8840

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-15T03:30:01Z

Weaknesses