CVE-2026-8840mediumCWE-862

CVE-2026-8840: fallo de gravedad media en wpdevart Booking calendar, Appointment Booking…

Booking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Booking calendar, Appointment Booking System

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.5%
The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to mark arbitrary reservations as paid or completed, cancel legitimate payments, auto-approve reservations, and trigger transactional booking emails by writing attacker-supplied payment status and transaction data directly into the payments table. The auto-approval of reservations is only triggered when the 'enable_psuccess_approval' site option is enabled, but payment status manipulation and email dispatch are exploitable regardless of that setting.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Productos afectados
wpdevart · Booking calendar, Appointment Booking System
CVEs relacionadas — wpdevart Booking calendar, Appointment Booking…

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-10856MEDIUMBooking Calendar WpDevArt <= 3.2.19 - Authenticated (Contributor+) SQL InjectionEPSS 0.5%CVE-2024-9504HIGHBooking calendar, Appointment Booking System <= 3.2.15 - Unauthenticated Stored Cross-Site Scripting via SVG File UploadEPSS 0.5%CVE-2026-15289MEDIUMBooking calendar, Appointment Booking System <= 3.2.17 - Unauthenticated Time-Based SQL Injection via 'wpdevart_id'EPSS 0.4%CVE-2024-12077MEDIUMBooking Calendar and Booking Calendar Pro <= Multiple Versions - Reflected Cross-Site Scripting via 'calendar_id'EPSS 0.4%CVE-2026-73395MEDIUMWordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.3%CVE-2026-57778MEDIUMWordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Broken Access Control vulnerabilityEPSS 0.3%