CVE-2026-77704
Amelia 1.2.32 - 2.4.8 - Amelia Customer+ Appointment Status Update and Self-Approval
- State
- Published
- Severity
- 2.7 Low
- Published
- Aug 29, 2026
- Updated
- Aug 30, 2026
- Reserved
- Aug 21, 2026
Description
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their own bookings that were left awaiting approval and overwriting another customer's booking status on a shared appointment.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 2.7 Low | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N | CISA-ADP |
Weaknesses
- CWE-863 Incorrect Authorization
Affected Products
| Product | Versions |
|---|---|
Booking for Appointments and Events CalendarUnknown |
|
References
- https://wpscan.com/vulnerability/7b444920-28c4-4e4c-b5fd-38fdc31aef0c/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.