Description

The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway. This lets an unauthenticated attacker obtain confirmed, fully paid appointments and events without any payment being collected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-12T06:16:24.860Z",
  "pubdate": "2026-09-12T06:16:24.860Z",
  "executiveSummary": "The Booking for Appointments and Events Calendar WordPress plugin prior to version 9.8.1 contains a critical payment verification vulnerability. The flaw allows unauthenticated remote attackers to manipulate the payment confirmation process during the booking flow.\nBy submitting a maliciously crafted, unauthenticated booking request, an attacker can designate a specific payment gateway—even one not configured by the site administrator—to force the application to flag a booking as 'paid' without any actual financial transaction occurring.\nThis vulnerability exposes affected systems to significant financial and operational risk, as attackers can secure service slots, appointments, or event registrations without providing payment. The lack of server-side validation regarding the authenticity of the payment gateway's callback or status report is the primary security failure.\nNo authentication or elevated privileges are required to initiate this attack, making it highly accessible to external threat actors. The impact includes loss of revenue, unauthorized reservation of resources, and potential denial-of-service for legitimate customers unable to book slots taken by fraudulent requests.",
  "technicalDetails": "The root cause of this vulnerability lies in an insecure implementation of the payment processing logic within the Booking for Appointments and Events Calendar plugin. Specifically, the application architecture fails to implement a robust, server-side 'source of truth' validation mechanism when transitioning a booking status to 'paid'.\nIn the vulnerable versions prior to 9.8.1, the plugin accepts user-supplied data in the booking request that identifies the payment gateway provider. The server-side logic trusts this unauthenticated input implicitly. When the booking request is processed, the system verifies the status based on the gateway name provided in the payload rather than querying an official API or validating a transaction token from the specified provider.\nThe attack flow follows a predictable pattern: 1) The attacker constructs a public, unauthenticated HTTP request targeting the plugin's booking endpoint. 2) The attacker injects a parameter within this request that specifies a payment gateway (e.g., PayPal, Stripe, or any gateway supported by the plugin, regardless of the site's current configuration). 3) Because the application fails to check if the specified gateway is actually active or configured on the backend, the processing script assumes the gateway's validation logic was triggered. 4) The plugin logic prematurely updates the booking status in the database to 'paid' or 'confirmed'. 5) The system completes the reservation process and updates the calendar availability, effectively locking the slot for the attacker without any funds being transferred.\nThis vulnerability highlights a critical failure in the Principle of Least Privilege and Input Validation, specifically regarding the trust placed in client-side controlled data during sensitive financial transactions. Because the application logic does not perform a secure handshake or a callback verification with the actual payment processor before finalization, it remains susceptible to logical state manipulation.\nAffected versions are limited to releases before 9.8.1. The attack is fully network-accessible and requires zero authentication, allowing an attacker to script mass registrations or service reservations. Post-exploitation, the attacker maintains a confirmed, paid booking status in the system, potentially bypassing manual review processes if the plugin automatically triggers notifications for 'paid' appointments."
}