EUVD-2026-80220
GHSA-cqfw-wgfw-rqrw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Anonymous network-reachable booking form with no auth or interaction, but impact limited to booking-state integrity with no confidentiality or availability loss.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Appointment Hour Booking WordPress plugin before 1.5.95 does not check every appointment in a booking submission against the capacity configured for its own slot, allowing unauthenticated visitors to take slots that are already fully booked.
AnalysisAI
Unauthenticated attackers can book time slots in the Appointment Hour Booking WordPress plugin (before 1.5.95) that have already reached their configured capacity, because each appointment in a multi-appointment booking submission is not validated against the capacity limit of its own slot. The plugin assigns a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N, integrity-only impact), meaning any anonymous visitor can submit a crafted booking form and overwrite or occupy fully booked slots, denying legitimate customers their reservations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against default configurations of the Appointment Hour Booking WordPress plugin, provided the site publishes a booking form that permits more than one appointment to be submitted in a single request (the flaw only manifests when the handler does not re-validate each appointment against its own slot capacity). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 3.1 scores this 5.3 with a fully remote, unauthenticated, low-complexity vector (AV:N/AC:L/PR:N/UI:N) but only a Low integrity impact and no confidentiality or availability impact at the metric level - an accurate reflection that the attacker corrupts booking state rather than executing code or exfiltrating data. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade the Appointment Hour Booking plugin to 1.5.95 or later from the WordPress plugin repository or via WP-CLI ('wp plugin update appointment-hour-booking'), and verify the installed version after upgrade since WordPress sometimes leaves stale plugin code. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Appointment Hour Booking
View allThe Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS via the E-mail field, as demonstrated by email_1. Ra
The Appointment Hour Booking WordPress plugin before 1.3.17 does not properly sanitize values used when creating new cal
Price manipulation in the Appointment Hour Booking WordPress plugin (all versions before 1.5.88) allows any unauthentica
Missing Authorization vulnerability in Appointment Hour Booking plugin <= 1.3.71 on WordPress. Rated high severity (CVSS
The Appointment Hour Booking WordPress plugin before 1.3.56 does not sanitise and escape a settings of its Calendar fiel
The Appointment Hour Booking WordPress plugin before 1.3.16 does not escape some of the Calendar Form settings, allowing
The Appointment Hour Booking plugin for WordPress is vulnerable to iFrame Injection via the ‘email’ or general field par
The Appointment Hour Booking Plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.3.7
Broken access control in the Appointment Hour Booking WordPress plugin (by Codepeople) versions up to and including 1.5.
Stored Cross-Site Scripting in the Appointment Hour Booking WordPress plugin (versions <= 1.5.86) allows authenticated c
The Appointment Hour Booking plugin for WordPress is vulnerable to CAPTCHA bypass in versions up to, and including, 1.3.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today