CVE-2026-77704: low-severity vulnerability in Booking for Appointments and Events Calendar
Amelia 1.2.32 - 2.4.8 - Amelia Customer+ Appointment Status Update and Self-Approval
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 2.7epss 0.3%
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their own bookings that were left awaiting approval and overwriting another customer's booking status on a shared appointment.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Affected products
Unknown · Booking for Appointments and Events Calendarpublic PoCs found — 1
cve_referencewpscan.com/vulnerability/7b444920-28c4-4e4c-b5fd-38fdc31aef0c/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Booking for Appointments and Events Calendar
In the same product, most dangerous first.
CVE-2026-77705HIGHAmelia < 2.4.10 - Amelia Manager+ WordPress Account TakeoverEPSS 0.5%CVE-2026-14215MEDIUMAmelia < 2.4.9 - Unauthenticated Post-Booking Action TriggerEPSS 0.4%CVE-2026-14216MEDIUMAmelia < 2.4.7 - Unauthenticated Notification Queue DispatchEPSS 0.4%CVE-2026-77689MEDIUMAmelia Pro 9.0 - 9.8 - Unauthenticated Payment BypassEPSS 0.3%CVE-2026-14212MEDIUMAmelia Pro < 9.8 - Provider+ Arbitrary Provider Password Update via IDOREPSS 0.3%CVE-2026-14214LOWAmelia < 2.4.4 - Amelia Manager+ Arbitrary User-Field Modification via Mass AssignmentEPSS 0.3%