CVE-2026-77689 — Amelia Pro 9.0 - 9.8 - Unauthenticated Payment Bypass
The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting th…
Published: 2026-09-12 · CVSS: 5.3 · CVSS 3.1
The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway. This lets an unauthenticated attacker obtain confirmed, fully paid appointments and events without any payment being collected.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7