Is CVE-2026-77689 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77689 being exploited in the wild.

How severe is CVE-2026-77689?

Medium severity, with a CVSS score of 5.3, published 12 September 2026.

Which products and versions are affected?

AmeliaBooking Amelia Pro 9.0 through 9.8.

Is there a fix for CVE-2026-77689?

A patch was published on 2026-09-12: Fixed in version 9.8.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-77689 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-77689?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77689: Amelia Pro payment bypass in booking endpoint

CVE-2026-77689 · Severity: medium · CVSS 5.3 · Published 2026-09-12

Amelia Pro is a WordPress plugin for managing appointments, events, and bookings. The plugin fails to verify that payment was actually processed before marking appointments as paid, allowing unauthenticated attackers to book and confirm appointments without paying anything. This means a business could lose revenue on all bookings made through the plugin, and customers could fraudulently obtain services without payment.

Quick answers

Is CVE-2026-77689 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77689 being exploited in the wild.
How severe is CVE-2026-77689?: Medium severity, with a CVSS score of 5.3, published 12 September 2026.
Which products and versions are affected?: AmeliaBooking Amelia Pro 9.0 through 9.8.
Is there a fix for CVE-2026-77689?: A patch was published on 2026-09-12: Fixed in version 9.8.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77689 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-77689?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authentication and authorization bypass (CWE-284) in the booking endpoint. When processing a booking request, the plugin trusts the payment gateway name specified in an unauthenticated POST request to the AJAX endpoint without verifying that the gateway is actually configured on the site or that payment was genuinely processed. An attacker can send a crafted JSON payload specifying any payment gateway (e.g., PayPal) and the booking is recorded as paid and approved immediately, before payment validation occurs. The commit happens before the payment stage, so even when the payment eventually fails, the booking remains in the database. The endpoint is publicly accessible without authentication, and no user interaction is required beyond crafting the POST request.

Affected products

AmeliaBooking Amelia Pro 9.0 through 9.8

Timeline

2026-09-10: disclosed
2026-09-12: advisory
2026-09-12: patched: Fixed in version 9.8.1

References

https://wpscan.com/vulnerability/ac597716-193d-419f-b55c-802ee979385e/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.