CVE-2026-77704— Amelia 1.2.32 - 2.4.8 - Amelia Customer+ Appointment Status Update and Self-Approval
Quick assessment
Affected
Unknown Booking for Appointments and Events Calendar
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 WordPress 插件“The Booking for Appointments and Events Calendar”版本 2.4.9 之前，未在执行更改预约状态的操作前校验用户是否具备所需权限，因此允许客户（顾客）为他们所预订的任意预约设置任意状态。这包括批准那些仍处于“待审批”状态的自身预订，以及覆盖同一共享预约上其他客户的预订状态。
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1207 · Rogue Domain ControllerAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Booking for Appointments and Events Calendar | 1.2.32< 2.4.9 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-77704
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Amelia 1.2.32 - 2.4.8 - Amelia Customer+ Appointment Status Update and Self-Approval
Source: CVE Program / CVE List V5
Vulnerability Description
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their own bookings that were left awaiting approval and overwriting another customer's booking status on a shared appointment.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Booking for Appointments and Events Calendar | 1.2.32 ~ 2.4.9 | - |
|
II. Public POCs for CVE-2026-77704
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-77704
请登录查看更多情报信息。
Other References for CVE-2026-77704 (1)
-
🔗 Amelia 1.2.32 – 2.4.8 – Amelia Customer+ Appointment Status Update and Self-Approval | CVE 2026-77704 | Plugin Vulnerabilities exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-08-29 · 26 CVEs total
| CVE-2026-76547 | Profile Builder < 4.0.1 - Admin+ PHP Object Injection via Import/Export | |
| CVE-2026-81200 | MasterStudy LMS < 3.7.42 - Instructor+ Cross-Tenant Order Billing PII Disclosure via IDOR | |
| CVE-2026-81342 | MasterStudy LMS < 3.7.43 - Unauthenticated Open Redirect | |
| CVE-2026-81346 | Frontend Admin by DynamiApps < 3.29.11 - Subscriber+ Arbitrary Membership Plan Deletion | |
| CVE-2026-81026 | MasterStudy LMS < 3.7.40 - Unauthenticated Payment Bypass via PayPal IPN | |
| CVE-2026-80311 | Stripe Payment Forms by WP Full Pay < 8.5.5 - Cross-Customer Subscription Cancellation via | |
| CVE-2026-80488 | WP Ultimate CSV Importer < 9.0 - Admin+ SQLi via AIOSEO Import Fields | |
| CVE-2026-77786 | Rank Math SEO < 1.0.277 - Editor+ Core Settings Modification via fix-site-seo Ability | |
| CVE-2026-76586 | BookingPress 1.5.6 - 1.6.2 - Unauthenticated Booking Price Manipulation via PayPal Payment | |
| CVE-2026-77010 | HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Moderator Jo | |
| CVE-2026-77012 | Icollect <= 1.0.0 - Unauthenticated Arbitrary File Read, SSRF and Path Traversal File Writ | |
| CVE-2026-77008 | HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Plugin Setti | |
| CVE-2026-77007 | HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated BigBlueButto | |
| CVE-2026-16259 | Uix UserCenter <= 1.0.3 - Unauthenticated Privilege Escalation | |
| CVE-2026-76548 | Profile Builder < 4.0.1 - Unauthenticated Unpublished Content and Media Modification via F | |
| CVE-2026-17520 | Newsletters < 4.17 - Unauthenticated API Access via Predictable API Key | |
| CVE-2026-17522 | Newsletters < 4.17 - Arbitrary Plugin Option Update via CSRF | |
| CVE-2026-76546 | Profile Builder < 4.0.1 - Contributor+ Stored XSS via Format Date Shortcode | |
| CVE-2026-19430 | CatFolders Document Gallery Pro < 2.0.7 - Unauthenticated Missing Authorization via downlo | |
| CVE-2026-18234 | MStore API < 4.21.1 - Subscriber+ Arbitrary Order Payment Bypass via Wallet |
Showing top 20 of 26 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Booking for Appointments and Events Calendar
-
CVE-2026-77689
Amelia Pro 9.0 - 9.8 - Unauthenticated Payment Bypass -
CVE-2026-77705
Amelia < 2.4.10 - Amelia Manager+ WordPress Account Takeover -
CVE-2026-14215
Amelia < 2.4.9 - Unauthenticated Post-Booking Action Trigger -
CVE-2026-14216
Amelia < 2.4.7 - Unauthenticated Notification Queue Dispatch -
CVE-2026-14212
Amelia Pro < 9.8 - Provider+ Arbitrary Provider Password Upd
Same vendor: Unknown
-
CVE-2026-110191
Product Delivery Date for WooCommerce – Lite < 3.3.2 - Contr -
CVE-2026-110015
Salon Booking System < 10.31.9 - Administrator Account Creat -
CVE-2026-110014
Salon Booking System < 10.31.9 - Unauthenticated Booking Cre -
CVE-2026-110179
affiliate-toolkit < 3.8.9 - Editor+ SQL Injection via orderb -
CVE-2026-110135
OTP Login & Register Woocommerce < 2.7.3 - Unauthenticated A
V. Comments for CVE-2026-77704
No comments yet