# Bookit — Booking & Appointment Calendar <= 2.6.0.5 - Unauthenticated Payment Bypass via 'payment_status' Parameter

- **ID:** WPSEC-2026-1142
- **Plugin:** Bookit — Booking & Appointment Calendar (`bookit`), https://wordpress.org/plugins/bookit/
- **Affected versions:** all versions before 2.6.0.6
- **Fixed in:** 2.6.0.6 (Update to 2.6.0.6 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-915
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/bookit
- **Fix released:** 2026-10-15
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1142/

## Description

The Bookit — Booking & Appointment Calendar plugin for WordPress is vulnerable to Payment Bypass via the 'payment_status' parameter of the public 'bookit_book_appointment' AJAX action in all versions up to, and including, 2.6.0.5, due to the booking handler passing every client-supplied POST field into the appointment data, including 'payment_status', which is then stored as the status of the booking's payment record. This makes it possible for unauthenticated attackers to create paid bookings that are recorded as already paid (complete) without making any payment.

## References

- https://wpsec.com/vuln/WPSEC-2026-1142/
- https://plugins.svn.wordpress.org/bookit/tags/2.6.0.6/
- https://wordpress.org/plugins/bookit/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1142/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.