Appointment Hour Booking CVE-2026-66679

No special conditions are required beyond a network-reachable WordPress installation running Appointment Hour Booking version 1.5.91 or earlier with the plugin active. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms unauthenticated remote exploitation against default plugin configurations - no admin credentials, no specific non-default settings, and no victim interaction are needed. What limits exploitation is the constrained impact scope: integrity and availability impacts are rated Low, meaning an attacker can manipulate booking data or degrade availability within the plugin's operational domain but cannot execute arbitrary code or access system-level resources. Sites not running this specific plugin are entirely unaffected. The CWE-1284 root cause suggests the flaw is triggered via specific numeric or quantity-type input fields in the booking interface, meaning only endpoints processing those parameters are the attack surface.

The CVSS 3.1 base score of 6.5 (Medium) is driven by AV:N/AC:L/PR:N/UI:N - network-reachable, low complexity, no authentication, no interaction - which represents a very low exploitation barrier. Impact is constrained to Low integrity (I:L) and Low availability (A:L) with no confidentiality impact (C:N), limiting the ceiling. The 'Information Disclosure' tag in Patchstack's report conflicts with C:N in the NVD vector; if information disclosure is a genuine impact, the true risk may be slightly higher than the scored 6.5. No EPSS score is provided in the available data, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public exploit code identified, suggesting this is not currently under active mass exploitation. The SSVC signals lean toward 'Track' rather than 'Act': exploitation is technically easy (AC:L, PR:N) but impact scope is limited and there is no confirmed weaponized exploit. For sites handling sensitive patient or client appointment data, the unavailability impact and potential for booking manipulation elevate practical risk beyond the raw score. Priority should be elevated for healthcare, legal, or service-industry sites where appointment integrity is operationally critical.

An unauthenticated attacker enumerates WordPress sites running the Appointment Hour Booking plugin (trivially detectable via plugin path fingerprinting), then sends a crafted HTTP request to an exposed booking endpoint with manipulated input parameters - such as an out-of-range quantity or slot count value - that bypasses server-side authorization checks. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L, PR:N, UI:N) means a motivated attacker could develop a working exploit from the Patchstack disclosure with minimal effort, potentially enabling unauthorized booking manipulation or service disruption.