Appointment Booking Plugin CVE-2026-105198

No special conditions beyond the vulnerable feature being reachable: the order confirmation summary flow of the Appointment Booking Plugin (before 5.7.3) renders an order's details based solely on a user-supplied order-item identifier without verifying caller ownership, and those identifiers are sequential/predictable. Exploitation requires only that booking confirmations exist and that the public confirmation endpoint is reachable (default behavior); no authentication, privileges, user interaction, or non-default configuration is needed. The only real limiters are that impact is confined to disclosure of customer name, contact details, and confirmation code (no write access, no credentials), and that the site must be running a pre-5.7.3 version with booking orders present to enumerate.

This is a confirmed authorization flaw (IDOR, CWE-639) with a network-exploitable CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scoring 5.3 Medium, driven entirely by low confidentiality impact (C:L) with no integrity or availability effect. The CVSS metrics are internally consistent with the description: an unauthenticated visitor can read other customers' data by supplying a guessable sequential order-item id, so the network vector and lack of privileges/interaction are accurate. No EPSS score, KEV listing, or public POC is present in the provided intelligence, so there is no evidence of active exploitation; exploitation status is best characterized as no public exploit identified at time of analysis. The real-world priority is moderate rather than urgent: the sequential, predictable identifier makes mass enumeration trivial and fully automatable, which raises practical risk above what a 5.3 score suggests, but the impact is limited to disclosure of names, contact details, and order confirmation codes (not credentials, payment data, or code execution). No signals conflict; the main limitation is the absence of exploitation-probability data (no EPSS/KEV/POC provided), so prioritization rests on the ease-of-enumeration argument rather than observed attacker activity.

An unauthenticated attacker requests the order confirmation summary endpoint and increments a sequential order-item id, scraping each response. Because identifiers are predictable and no ownership check is enforced, the attacker enumerates the full customer base, harvesting names, contact details, and confirmation codes. The attack is fully remote and requires no authentication or user interaction (AV:N/PR:N/UI:N); no public POC is identified in the provided data.