Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-77689

Amelia Pro 9.0 - 9.8 - Unauthenticated Payment Bypass

cve-program · severity unknownCVSS unknownCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-77689

Published

The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway. This lets an unauthenticated attacker obtain confirmed, fully paid appointments and events without any payment being collected.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-77689

Published

Booking for Appointments and Events Calendar

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Unknown",
                    "product": "Booking for Appointments and Events Calendar",
                    "versions": [
                        {
                            "status": "affected",
                            "versionType": "semver",
                            "version": "9.0",
                            "lessThan": "9.8.1"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON