CVE-2026-8840 wpdevart CVE debrief

Who should care

WordPress administrators and users of the Booking calendar, Appointment Booking System plugin, as well as security teams monitoring for potential unauthorized actions on reservations and payments, should be aware of this vulnerability. They should assess their exposure, apply necessary updates, and monitor for suspicious activity related to payment status changes and transactional booking emails. Additionally, they should verify that the 'enable_psuccess_approval' site option is not enabled to prevent auto-approval of reservations. Security teams should prioritize this vulnerability as medium priority due to its potential impact on reservation and payment integrity.

Technical summary

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass due to improper verification of user authorization. This allows unauthenticated attackers to perform actions such as marking reservations as paid or completed, canceling legitimate payments, and triggering transactional booking emails. The plugin's failure to verify user authorization enables attackers to write arbitrary payment status and transaction data directly into the payments table, potentially leading to unauthorized actions on reservations and payments.

Defensive priority

Medium priority due to potential for unauthorized actions

Recommended defensive actions

• Review and update the Booking calendar, Appointment Booking System plugin to version 3.2.37 or later
• Verify that the 'enable_psuccess_approval' site option is not enabled
• Monitor for suspicious payment status changes and transactional booking emails
• Implement additional authentication and authorization checks for payment and reservation actions
• Perform a thorough review of system logs to identify potential unauthorized actions
• Conduct an asset inventory to identify all instances of the vulnerable plugin
• Establish a rollback change window for emergency patches if needed

Evidence notes

Evidence is based on limited details from the CVE and NVD records, with additional information from Wordfence security research. Further verification is needed to confirm the full scope of the vulnerability.

Official resources