CVE-2026-77689: Amelia Pro 9.0 - 9.8 - Unauthenticated Payment Bypass
The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway. This lets an unauthenticated attacker obtain confirmed, fully paid appointments and events without any payment being collected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Booking for Appointments and Events Calendar WordPress pluginto a version that resolves this vulnerability.Fixed in 9.8.1
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
Sites using the Booking for Appointments and Events Calendar WordPress plugin before version 9.8.1 are exposed. The issue can be triggered even when the payment gateway supplied in the booking request has never been configured on the site.
Does an attacker need an account or a legitimate payment to exploit it?
No. The vulnerable booking request is public and unauthenticated, and the attacker can have an appointment or event booking recorded as fully paid without payment being collected.
What should be done if the plugin cannot be updated immediately?
The provided information does not specify a workaround. Because exploitation targets public booking requests, review confirmed paid appointments and event bookings for payments that cannot be verified.
How can administrators check whether exploitation may have occurred?
Compare bookings marked as paid or confirmed against actual payment records from the relevant payment provider. Investigate paid bookings associated with gateways that were not configured on the site.