Vulnerability · Published Aug 29, 2026 · Assigned by WPScan
CVE-2026-76586BookingPress 1.5.6 - 1.6.2 - Unauthenticated Booking Price Manipulation via PayPal Payment Confirmation
High 7.5
In plain English
A high-severity improper access control in Appointment Booking Calendar Plugin and Scheduling Plugin from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 70.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment, allowing unauthenticated users to have a paid appointment approved for a fraction of its price.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Appointment Booking Calendar Plugin and Scheduling Plugin | 1.5.6 – before 1.6.3 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
- https://wpscan.com/vulnerability/bc74bc9b-92ce-434e-a21d-34d7525c8600/ exploit, vdb-entry, technical-description