CVE-2026-77689
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Sep 12, 2026
Vendor
unknown
Description
The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway. This lets an unauthenticated attacker obtain confirmed, fully paid appointments and events without any payment being collected.