https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T13:29:32.054008+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-77689 fkie_cve-2026-77689 2026-09-29T13:29:32.085084+00:00

The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway. This lets an unauthenticated attacker obtain confirmed, fully paid appointments and events without any payment being collected.

 https://vulnerability.circl.lu/vuln/ghsa-mqrq-3vgp-g3ff GHSA-mqrq-3vgp-g3ff 2026-09-29T13:29:32.085194+00:00

The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway. This lets an unauthenticated attacker obtain confirmed, fully paid appointments and events without any payment being collected.