CVE-2026-77704 in Booking for Appointments and Events Calendar Plugin
Summary
by MITRE • 08/29/2026
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their own bookings that were left awaiting approval and overwriting another customer's booking status on a shared appointment.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/29/2026
The Booking for Appointments and Events Calendar WordPress plugin prior to version 2.4.9 contains a critical authorization flaw rooted in the absence of proper capability verification during state transitions. Specifically, the application logic governing the modification of an appointment's status fails to validate whether the initiating user possesses the necessary administrative or managerial privileges required for such actions. This oversight represents a classic instance of Insecure Direct Object Reference combined with Broken Access Control, where the system trusts client-supplied input regarding the desired state change without verifying the requester's identity and permissions against the resource being modified. The vulnerability allows any authenticated user to manipulate the status fields associated with appointment records they have access to view or interact with, bypassing intended security boundaries designed to restrict such modifications to authorized personnel only.
From a technical perspective, this flaw enables customers to perform actions that are strictly reserved for administrators or staff members managing the calendar system. By exploiting this lack of server-side authorization checks, an attacker can arbitrarily set the status of any appointment linked to their user profile. This includes changing pending appointments from awaiting approval to approved, effectively self-approving bookings without requiring validation by a human operator. Furthermore, in scenarios involving shared or group appointments where multiple users might be associated with a single event record, this vulnerability allows one customer to overwrite the booking status of another participant. The application processes these requests based on the appointment identifier rather than verifying if the user has jurisdiction over that specific administrative action, leading to unauthorized state mutations within the database.
The operational impact of this vulnerability is significant for businesses relying on accurate scheduling and resource management through WordPress. Allowing users to self-approve bookings undermines the integrity of the approval workflow, potentially resulting in double-bookings, resource conflicts, or service delivery failures if capacity limits are exceeded without proper oversight. Additionally, the ability to overwrite another customer's booking status can lead to data corruption and user dissatisfaction, as legitimate reservations may be inadvertently cancelled or altered by malicious actors. This erosion of trust in the scheduling system can have direct financial implications for businesses that depend on confirmed appointments for revenue generation. The flaw essentially transforms a standard administrative function into an open vector for abuse by any authenticated account holder.
This vulnerability aligns with Common Weakness Enumeration identifiers such as CWE-862, which describes Missing Authorization, and CWE-915 regarding Improper Control of Dynamically-Identified Variables. In the context of the MITRE ATT&CK framework, this behavior corresponds to techniques involving Privilege Escalation or Defense Evasion through manipulation of application logic to bypass intended restrictions. To mitigate this risk, administrators must upgrade the plugin to version 2.4.9 or later, where these authorization checks have been implemented. Until an update is applied, it is advisable to restrict access to the affected endpoints if possible and monitor for unusual patterns in appointment status changes that do not correspond with administrative login activity. Regular security audits of WordPress plugins are essential to ensure that critical business logic remains protected against unauthorized state transitions.