CVE-2026-76586: Unknown Appointment Booking Calendar Plugin And Scheduling Plugin

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment, allowing unauthenticated users to have a paid appointment approved for a fraction of its price.

Affected products

• Unknown Appointment Booking Calendar Plugin And Scheduling Plugin: from 1.5.6, before 1.6.3 (fixed in 1.6.3)

Published 2026-08-29. Last modified 2026-08-31.