Unauthorized WordPress Account Takeover via Appointment Plugin

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the password and email address of other users' WordPress accounts and take them over.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-77705 exposes a critical authorization flaw in the Booking for Appointments and Events Calendar WordPress plugin, where improper access controls allow users with customer or employee management permissions to modify other users' WordPress accounts—specifically resetting passwords and changing email addresses. This vulnerability affects WordPress sites running the plugin before version 2.4.10 and poses significant risk to multi-user environments, particularly those managing appointment systems with delegated administrative roles. An attacker with customer or employee management capabilities can escalate privileges by taking over legitimate WordPress accounts, including administrator accounts, leading to complete site compromise, data theft, and malware deployment.

Casky's 283 matching security skills leverage Claude's extended reasoning to map this vulnerability across two critical MITRE ATT&ACK tactics: TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would detect attack patterns including unauthorized account modification attempts, suspicious password reset activities linked to the Amelia plugin, and lateral privilege escalation from customer/employee roles to administrative accounts. The platform's skill coverage would highlight detection opportunities at the access control validation layer, identifying missing authorization checks before account modifications are processed, and flag anomalous credential changes originating from non-administrative plugin interfaces—enabling teams to catch exploitation attempts before account takeover occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-77705.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-77705

Casky has 283 skills that investigate the attack patterns behind CVE-2026-77705. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn