Description

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment, allowing unauthenticated users to have a paid appointment approved for a fraction of its price.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-29T06:17:34.353Z",
  "pubdate": "2026-08-29T06:17:34.353Z",
  "executiveSummary": "The Appointment Booking Calendar Plugin and Scheduling Plugin for WordPress, in versions prior to 1.6.3, contains a critical flaw in its payment verification logic. This vulnerability is classified as an improper verification of cryptographic or financial signatures, leading to potential unauthorized authorization of bookings.\nThe vulnerability allows an unauthenticated attacker to manipulate the transaction process. By intercepting or manually crafting payment requests, a user can submit an arbitrarily low amount for a service that mandates a higher price. Because the plugin fails to perform a server-side reconciliation between the expected booking cost and the actual payment received from the gateway, it incorrectly marks the transaction as successful and confirms the appointment.\nThe risk implication is significant for site administrators, as it facilitates financial loss and unauthorized resource allocation. Attackers do not require elevated privileges or authentication to exploit this flaw, as the vulnerable endpoint is accessible to any public user interacting with the booking process. This issue compromises the integrity of the e-commerce transaction flow within the plugin.",
  "technicalDetails": "The root cause of this vulnerability lies in an insecure implementation of the payment validation routine within the backend processing logic. During the appointment scheduling workflow, the plugin initiates a transaction where a price is staged; however, the subsequent confirmation phase relies on client-side input or incomplete server-side verification to finalize the booking status.\nWhen a user initiates a payment, the plugin fails to perform a secondary verification against the payment gateway’s API response or a server-side session variable to ensure the amount paid matches the price defined in the database. The application logic trusts the data returned in the payment callback or the initial transaction request without validating that the transaction amount corresponds to the specific booking ID requested.\nThe attack flow proceeds as follows: First, an attacker initiates a legitimate booking process for a high-value appointment. During the payment redirect or the webhook interaction phase, the attacker modifies the request body—or uses a proxy tool to intercept the communication between the browser and the plugin—to inject a minimal payment value. The plugin, failing to perform an independent server-side lookup of the required price, interprets the incoming request as a valid notification of success.\nConsequently, the plugin triggers its post-payment success function, which updates the booking status in the WordPress database to 'confirmed' or 'paid.' This effectively bypasses the payment gateway's pricing enforcement. Because the verification logic does not compare the transaction identifier and the amount against the internal staging parameters, the system is susceptible to price manipulation.\nThe vulnerability affects all versions of the Appointment Booking Calendar Plugin and Scheduling Plugin before 1.6.3. The exploitation is entirely remote, requiring only network access to the booking page. No authentication is necessary, as the payment verification endpoint is typically exposed to handle public transactions. Successful exploitation results in the unauthorized fulfillment of services, direct financial loss for the merchant, and potential disruption of scheduling operations due to fraudulent bookings."
}