Wp Time Slots Booking Form CVE-2026-32432

The CVSS 5.3 score reflects a medium-severity vulnerability with low attack complexity (AC:L) and no authentication requirements (PR:N), indicating straightforward exploitability. However, the impact is limited to integrity (I:L) with no confidentiality or availability impact, suggesting the attacker can modify but not delete or exfiltrate data. The SSVC framework would likely classify this as having high exploitability (network-accessible, no auth required), potentially automatable (if a PoC targeting REST/AJAX endpoints exists), but limited technical impact (booking data modification only, not system compromise). The real-world risk is elevated by the fact that appointment/booking plugins are commonplace in small-to-medium business WordPress installations, potentially affecting thousands of sites. Unlike arbitrary code execution vulnerabilities, this authorization bypass is unlikely to be mass-exploited by automated worms but presents a targeted risk to organizations relying on accurate booking integrity. Patch availability and version recency (current version at time of disclosure) will determine urgency; organizations on older versions face higher risk if the plugin is internet-facing.

An unauthenticated attacker discovers the booking form endpoint (e.g., via AJAX action handlers or REST API routes that lack proper nonce/capability checks) and sends HTTP requests to modify existing appointments—for example, changing the booking time, customer information, or status to 'completed' without paying for the service. Because the vulnerability requires no authentication (PR:N) and low complexity (AC:L), the attacker can automate this via a simple script, potentially disrupting bookings for a business's customers or manipulating appointment data for financial fraud. A proof-of-concept would demonstrate crafting a POST request with booking parameters to the vulnerable endpoint and confirming data modification without WordPress authentication cookies or nonces.