Medium severity · published Sep 12, 2026
CVE-2026-77689
Amelia Pro 9.0 - 9.8 - Unauthenticated Payment Bypass
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway. This lets an unauthenticated attacker obtain confirmed, fully paid appointments and events without any payment being collected.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BF
Booking for Appointments and Events Calendar ·
9.0 before 9.8.1 · source: vendor
Affected product
BF
Booking for Appointments and Events Calendar
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-77689
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-77689
wpscan.com
https://wpscan.com/vulnerability/ac597716-193d-419f-b55c-802ee979385e/
More from Booking for Appointments and Events Calendar
7.2
CVE-2026-77705
Amelia < 2.4.10 - Amelia Manager+ WordPress Account Takeover
6.5
CVE-2026-14215
Amelia < 2.4.9 - Unauthenticated Post-Booking Action Trigger
6.5
CVE-2026-14216
Amelia < 2.4.7 - Unauthenticated Notification Queue Dispatch
4.7
CVE-2026-14212
Amelia Pro < 9.8 - Provider+ Arbitrary Provider Password Update via IDOR
3.8
CVE-2026-14211
Amelia Pro < 9.7 - Provider+ Arbitrary Customer Data Disclosure and Modification via IDOR