CVE-2026-76586 — BookingPress 1.5.6 - 1.6.2 - Unauthenticated Booking Price Manipulation via PayPal Payment Confirmation

CVE-2026-76586

BookingPress 1.5.6 - 1.6.2 - Unauthenticated Booking Price Manipulation via PayPal Payment Confirmation PUBLISHED

Description (CNA)

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment, allowing unauthenticated users to have a paid appointment approved for a fraction of its price.

Affected (CNA)

Vendor / product	Versions
Unknown / Appointment Booking Calendar Plugin and Scheduling Plugin	affected 1.5.6 before 1.6.3

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/bc74bc9b-92ce-434e-a21d-34d7525c8600/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.