What is the CVSS score of CVE-2026-5693?

CVE-2026-5693 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Smart Appointment & Booking CVE-2026-5693

EUVD-2026-29399 MEDIUM

Missing Authorization (CWE-862)

2026-05-12 Wordfence

GHSA-jx49-jgx5-x37f

Authentication Bypass WordPress

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 08:48 vuln.today

CVE Published

May 12, 2026 - 07:48 nvd

MEDIUM 5.3

DescriptionCVE.org

The Smart Appointment & Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and a nonce validation logic flaw in the saab_cancel_booking() function in all versions up to, and including, 1.0.8. The nonce check uses && (AND) instead of || (OR), which means providing any value for the security parameter causes the entire check to be skipped. This makes it possible for unauthenticated attackers to cancel arbitrary bookings by supplying a predictable booking ID.

AnalysisAI

Unauthenticated attackers can cancel arbitrary bookings in the Smart Appointment & Booking WordPress plugin versions up to 1.0.8 due to a logic flaw in nonce validation that uses AND instead of OR, combined with a missing capability check in the saab_cancel_booking() function. By supplying any value for the security parameter and a predictable booking ID, attackers can modify or delete booking records without authentication or user interaction.

Technical ContextAI

The vulnerability exists in the saab_cancel_booking() function within the Smart Appointment & Booking WordPress plugin's front-end action handler class. WordPress nonce validation typically uses wp_verify_nonce() to ensure requests originate from authenticated sessions; however, this implementation contains a logical operator flaw where the nonce check uses && (AND) instead of || (OR). This causes the security check to be bypassed when any value is provided for the nonce parameter, inverting the intended validation logic. Combined with the absence of a capability check (CWE-862: Missing Authorization), the function fails to verify that the requesting user has permission to cancel bookings. The plugin's architectural assumption that predictable or enumerable booking IDs are protected by the nonce check proves invalid due to this logic error.

RemediationAI

Update the Smart Appointment & Booking plugin to version 1.0.9 or later, which should correct the nonce validation logic and implement proper capability checks. To update, navigate to the WordPress Dashboard, go to Plugins > Installed Plugins, locate Smart Appointment & Booking, and click Update if available; alternatively, download the patched version from https://wordpress.org/plugins/smart-appointment-booking/ and manually upload it. As an immediate workaround for unpatched installations, disable the plugin entirely until a patch is available, or restrict access to the booking cancellation endpoint by implementing server-level IP whitelisting or adding authentication requirements at the web server level (e.g., via .htaccess or nginx configuration). Be aware that disabling the plugin prevents all booking functionality, not just cancellation. A temporary code-level fix (for sites comfortable with PHP modification) would be to manually correct the nonce logic from && to || in the saab_cancel_booking() function, though this approach is not recommended for production without code review and introduces maintenance burden during future updates.