EUVD-2026-60933
GHSA-j37p-88hf-r5j6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Raising C to L to reflect the Patchstack 'Information Disclosure' tag not captured in NVD's C:N; all other metrics align with unauthenticated network-accessible BAC in a WordPress plugin.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Broken Access Control in Appointment Hour Booking <= 1.5.91 versions.
AnalysisAI
Broken access control in the Appointment Hour Booking WordPress plugin (by Codepeople) versions up to and including 1.5.91 permits unauthenticated remote attackers to bypass authorization checks, resulting in unauthorized integrity and availability impact. Reported by Patchstack and tracked as EUVD-2026-60933, the flaw requires no credentials, no user interaction, and no special configuration - any network-reachable WordPress installation running an affected plugin version is exposed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond a network-reachable WordPress installation running Appointment Hour Booking version 1.5.91 or earlier with the plugin active. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 6.5 (Medium) is driven by AV:N/AC:L/PR:N/UI:N - network-reachable, low complexity, no authentication, no interaction - which represents a very low exploitation barrier. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker enumerates WordPress sites running the Appointment Hour Booking plugin (trivially detectable via plugin path fingerprinting), then sends a crafted HTTP request to an exposed booking endpoint with manipulated input parameters - such as an out-of-range quantity or slot count value - that bypasses server-side authorization checks. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L, PR:N, UI:N) means a motivated attacker could develop a working exploit from the Patchstack disclosure with minimal effort, potentially enabling unauthorized booking manipulation or service disruption. |
| Remediation | The primary remediation is to update the Appointment Hour Booking plugin to a version above 1.5.91 once a patched release is published by Codepeople; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/appointment-hour-booking/vulnerability/wordpress-appointment-hour-booking-plugin-1-5-91-broken-access-control-vulnerability should be monitored for the confirmed fix version, as no exact patched release number is available in the current data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Appointment Hour Booking
View allThe Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS via the E-mail field, as demonstrated by email_1. Ra
The Appointment Hour Booking WordPress plugin before 1.3.17 does not properly sanitize values used when creating new cal
Price manipulation in the Appointment Hour Booking WordPress plugin (all versions before 1.5.88) allows any unauthentica
Missing Authorization vulnerability in Appointment Hour Booking plugin <= 1.3.71 on WordPress. Rated high severity (CVSS
The Appointment Hour Booking WordPress plugin before 1.3.56 does not sanitise and escape a settings of its Calendar fiel
The Appointment Hour Booking WordPress plugin before 1.3.16 does not escape some of the Calendar Form settings, allowing
The Appointment Hour Booking plugin for WordPress is vulnerable to iFrame Injection via the ‘email’ or general field par
The Appointment Hour Booking Plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.3.7
Stored Cross-Site Scripting in the Appointment Hour Booking WordPress plugin (versions <= 1.5.86) allows authenticated c
The Appointment Hour Booking plugin for WordPress is vulnerable to CAPTCHA bypass in versions up to, and including, 1.3.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today