Appointment Hour Booking CVE-2026-86475

No special conditions - remote unauthenticated exploitation against default configurations of the Appointment Hour Booking WordPress plugin, provided the site publishes a booking form that permits more than one appointment to be submitted in a single request (the flaw only manifests when the handler does not re-validate each appointment against its own slot capacity). Limits on exploitation: the target slot must already be at or above its configured capacity for the bypass to have any effect, the site must expose the booking form anonymously (forms restricted to logged-in users or approval-moderated bookings blunt the impact), and impact is confined to booking-table integrity - no code execution, file read, or data exfiltration is demonstrated. Authentication requirements are confirmed by the CVSS vector as PR:N (unauthenticated).

CVSS 3.1 scores this 5.3 with a fully remote, unauthenticated, low-complexity vector (AV:N/AC:L/PR:N/UI:N) but only a Low integrity impact and no confidentiality or availability impact at the metric level - an accurate reflection that the attacker corrupts booking state rather than executing code or exfiltrating data. WPScan confirms publicly available exploit code, so weaponization is trivial for anyone wanting to grief a booking calendar, yet there is no CISA KEV entry and no evidence of targeted or widespread exploitation, which keeps real-world priority moderate. The practical harm is operational and financial (double-booked resources, cancelled or displaced legitimate reservations, support burden) rather than a compromised server; defenders running appointment-driven services (clinics, salons, rentals, consultancies) should still patch promptly because the abuse is anonymous and automatable. No SSVC exploitation status beyond 'POC' is provided, and no EPSS score was supplied - treat the mass-exploitation likelihood as unquantified rather than low by default.

An attacker (or a competitor, or a script) identifies a public booking page for a service whose slots are already fully booked and submits a crafted multi-appointment booking request that targets one or more of those saturated slots. Because the plugin validates capacity for the submission as a whole rather than per appointment, the over-capacity reservation is accepted, consuming the slot and displacing or confusing legitimate bookings. The attack is unauthenticated, low complexity, and repeatable at scale with publicly available exploit code, so an entire day's schedule can be saturated for nuisance or competitive advantage.