Description

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to mark arbitrary reservations as paid or completed, cancel legitimate payments, auto-approve reservations, and trigger transactional booking emails by writing attacker-supplied payment status and transaction data directly into the payments table. The auto-approval of reservations is only triggered when the 'enable_psuccess_approval' site option is enabled, but payment status manipulation and email dispatch are exploitable regardless of that setting.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-15T03:16:48.357Z",
  "pubdate": "2026-08-15T03:16:48.357Z",
  "executiveSummary": "The Booking calendar, Appointment Booking System plugin for WordPress in all versions up to, and including, 3.2.36 is susceptible to an authorization bypass vulnerability.\nThe flaw stems from insufficient authorization verification checks when handling sensitive reservation and payment actions.\nThis security deficiency enables unauthenticated remote threat actors to manipulate payment status and transaction data by writing directly into the payments table.\nThe resulting impact includes the unauthorized marking of arbitrary reservations as paid or completed, the cancellation of legitimate payments, the auto-approval of reservations when the 'enable_psuccess_approval' site option is active, and the unauthorized dispatch of transactional booking emails.\nAttackers require no prior authentication or privileges to exploit this vulnerability over the network, posing significant operational and data integrity risks to affected WordPress installations.",
  "technicalDetails": "The root cause of the vulnerability resides in the authorization logic of the Booking calendar, Appointment Booking System plugin, specifically within its handling of payment status and transaction data updates across all versions up to, and including, 3.2.36.\nThe plugin fails to properly verify whether a requesting user possesses the requisite authorization to perform administrative or state-changing actions on reservations and transactions.\nThe attack vector is network-based and exploitable by unauthenticated attackers without requiring any prior privileges within the WordPress environment.\nDuring exploitation, an attacker crafts an arbitrary payload containing malicious payment status and transaction data.\nBy submitting this payload to the vulnerable endpoint, the attacker bypasses access controls and writes directly into the underlying payments table.\nThis direct database write manipulation alters reservation states, allowing unauthenticated entities to falsely mark arbitrary reservations as paid or completed, disrupt operations by canceling legitimate payments, and trigger transactional booking emails.\nFurthermore, if the 'enable_psuccess_approval' site option is explicitly enabled on the target site, the manipulation successfully triggers the auto-approval of reservations.\nHowever, payment status manipulation and email dispatch functionalities remain exploitable regardless of the configuration state of the 'enable_psuccess_approval' site option.\nThe post-exploitation impact compromises the integrity of financial tracking, booking workflows, and communications within the affected appointment system."
}