Description

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their own bookings that were left awaiting approval and overwriting another customer's booking status on a shared appointment.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.7",
  "pubDate": "2026-08-29T06:17:44.150Z",
  "pubdate": "2026-08-29T06:17:44.150Z",
  "executiveSummary": "The Booking for Appointments and Events Calendar WordPress plugin prior to version 2.4.9 contains an Insecure Direct Object Reference (IDOR) and missing function-level access control vulnerability.\nThe vulnerability resides in the appointment management logic, where the plugin fails to perform server-side capability checks to verify if the requester possesses administrative or operator privileges before modifying an appointment's status.\nThis flaw allows unprivileged, authenticated customers to manipulate the status of any appointment they are associated with. The impact is significant, as it enables users to bypass business logic workflows—such as self-approving bookings that require manual administrative review—and potentially interfere with the bookings of other users in shared event scenarios.\nThe attack requires a low-privileged authenticated account to reach the affected endpoint. By intercepting and modifying the request parameters, an attacker can coerce the application into executing unauthorized state changes. This integrity violation undermines the booking workflow and represents a failure in authorization enforcement within the plugin's architecture.",
  "technicalDetails": "The root cause of this vulnerability is the absence of a proper authorization check (e.g., current_user_can()) within the appointment status update handler. The plugin processes requests to modify appointment statuses without validating whether the user identity associated with the session is authorized to perform such administrative modifications.\nThe attack flow begins with the attacker identifying the target appointment ID. By submitting a crafted HTTP request (typically POST) intended to update an appointment status, the attacker can specify a status parameter (e.g., changing 'pending' to 'approved'). Because the server-side code does not verify the user's role, the application logic proceeds to update the database record directly.\nIn a shared appointment context, this vulnerability can be leveraged to escalate impact. If the application logic relies on simple ID verification without mapping the user ID to the specific appointment ownership metadata, an attacker may be able to manipulate records belonging to other participants. By tampering with the request parameters, the attacker forces the underlying database query to execute, effectively overwriting the integrity of the booking calendar.\nAffected versions include all releases of the Booking for Appointments and Events Calendar plugin prior to version 2.4.9. The vulnerability is accessible over the network via standard HTTP/HTTPS channels, requiring only a standard subscriber-level account to execute the transition. Since the plugin fails to validate user capabilities, the backend controller trusts the request parameters implicitly.\nPost-exploitation, an attacker gains the ability to finalize their own bookings without administrative oversight, potentially causing scheduling conflicts or resource allocation issues. In environments where external payments are integrated with approval statuses, this could lead to service consumption without proper validation. The lack of granular permission checks ensures that the application operates in an insecure state, where the integrity of the scheduling system is entirely dependent on client-side requests which can be easily manipulated by an intercepting proxy or browser-based developer tools."
}