Wappointment CVE-2026-39756

No authentication, user interaction, or special privileges are required (PR:N/UI:N confirmed by CVSS), so exploitation works against default configurations of any Wappointment installation up to and including 2.7.7 that is network-reachable. The practical prerequisite is simply HTTP access to the WordPress site running the affected plugin version and knowledge or enumeration of valid object identifiers. Limiting factors: impact is bounded to data accessible via the vulnerable object reference (partial confidentiality/integrity, no availability loss), and sites updated past 2.7.7 or not running Wappointment are unaffected; the exact affected endpoint is not disclosed, which modestly raises the effort to locate the vulnerable parameter.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable, low-complexity, unauthenticated exploitation requiring no user interaction - the easiest possible access profile - which is why unauthenticated IDOR against a web plugin warrants attention. However, the impact is constrained: C:L/I:L/A:N means only partial confidentiality and integrity loss (reading/altering appointment-related records) with no availability impact, yielding the 6.5 Medium score rather than Critical. No EPSS probability, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or at-scale exploitation - consistent with a recently disclosed plugin bug reported through Patchstack. The SSVC exploitation status is therefore effectively 'none' from available signals, and automatability is plausible (the attack is a simple parameterized web request) but unconfirmed. Net: real and easy to trigger if a vulnerable instance is exposed, but the limited blast radius and absence of exploitation signals place it below network-vector CRITICAL flaws in queue priority. Note the input tag 'Authentication Bypass' is imprecise - CWE-639 is an authorization (access-control) flaw, not authentication bypass.

An unauthenticated attacker who can reach the WordPress site sends a request to a Wappointment endpoint with a manipulated object identifier (e.g., an appointment, booking, or client record ID) and the application returns or modifies data belonging to a different user. Because no authentication, special complexity, or user interaction is required, the request can be issued directly against any internet-facing vulnerable install. No public exploit code was identified in the provided data.