CVE-2026-77689
Amelia Pro 9.0 - 9.8 - Unauthenticated Payment Bypass
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway. This lets an unauthenticated attacker obtain confirmed, fully paid appointments and events without any payment being collected.
| Vendor | unknown |
| Product | booking for appointments and events calendar |
| Published | Sep 12, 2026 |
| Last Updated | Sep 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown booking for appointments and events calendar
Be the first to know when new medium vulnerabilities affecting unknown booking for appointments and events calendar are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Booking for Appointments and Events Calendar
9.0 < 9.8.1
References
Credits
Pedro Pinho WPScan