CVE-2026-77705

HighCVSS 7.2/10Last modified Sep 14, 2026

Description

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the password and email address of other users' WordPress accounts and take them over.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
Unknown	Booking for Appointments and Events Calendar	< 2.4.10

References

https://wpscan.com/vulnerability/bfd0ce74-f91e-41fe-8288-7b1d34dd16fe/

Timeline

Published: Sep 12, 2026
Last modified: Sep 14, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-777066.5Improper handling of highly compressed data (data amplification) vulnerability in Fileorbis Bilişim Hizmetleri Ticaret Anonim Şirketi FileOr CVE-2026-777075.9Improper certificate validation vulnerability in HAVELSAN Inc. Liman Render Engine allows Adversary in the Middle (AiTM). This issue affect CVE-2026-777085.9A pre-authentication stack-based buffer overflow vulnerability has been identified in the SonicOS TACACS+ authentication client, which in sp CVE-2026-777095.9A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS TACACS+ authentication client, which in spe CVE-2026-77715.5IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a trap when compiling a specially crafted statements containing su CVE-2026-777106.9A vulnerability in misp-stix could allow a crafted STIX document to influence security-sensitive MISP attribute metadata during import. The CVE-2026-777118.2When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required CVE-2026-777384.3A server-side request forgery vulnerability in the Credential API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080 CVE-2026-77746.9tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later a CVE-2026-77754.8IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway CVE-2026-777518.8A path traversal vulnerability existed in the handling of MISP object template names during STIX 2 import and MISP-to-STIX 2 export. MISP o CVE-2026-777527.2The Temporary Login Without Password WordPress plugin before 1.9.9 does not verify that the user requesting a temporary login holds network