CVE-2026-77704: Amelia 1.2.32 - 2.4.8 - Amelia Customer+ Appointment Status Update and Self-Approval

Q: Who can exploit this issue?

A customer who is booked on an appointment can exploit it. The customer can change the status of that appointment without holding the required capability.

Q: What could an attacker do with access to a shared appointment?

They can set arbitrary appointment statuses, including approving their own booking when it is awaiting approval. On a shared appointment, they can also overwrite another customer's booking status.

Q: Which plugin versions are affected?

Versions before 2.4.9 of the Booking for Appointments and Events Calendar WordPress plugin are affected. The reported affected range is Amelia 1.2.32 through 2.4.8.

Published Aug 29, 2026

Updated

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their own bookings that were left awaiting approval and overwriting another customer's booking status on a shared appointment.

Affected Software

1 affected component

WordPress plugin "Booking for Appointments and Events Calendar"<2.4.9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Booking for Appointments and Events Calendar WordPress plugin to a version that resolves this vulnerability.
Fixed in 2.4.9
Compensating control
Restrict access so non-privileged users cannot change appointment status (e.g., enforce capability checks at the application layer / via role-based access control) until all sites are upgraded to 2.4.9 or later.

Event History

Aug 29, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

A customer who is booked on an appointment can exploit it. The customer can change the status of that appointment without holding the required capability.

What could an attacker do with access to a shared appointment?

They can set arbitrary appointment statuses, including approving their own booking when it is awaiting approval. On a shared appointment, they can also overwrite another customer's booking status.

Which plugin versions are affected?

Versions before 2.4.9 of the Booking for Appointments and Events Calendar WordPress plugin are affected. The reported affected range is Amelia 1.2.32 through 2.4.8.

CVE-2026-77704: Amelia 1.2.32 - 2.4.8 - Amelia Customer+ Appointment Status Update and Self-Approval

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What could an attacker do with access to a shared appointment?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What could an attacker do with access to a shared appointment?

Which plugin versions are affected?