What is the CVSS score of CVE-2026-9188?

CVE-2026-9188 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.5%.

Wappointment CVE-2026-9188

EUVD-2026-41260 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-02 Wordfence

GHSA-x67v-h94m-3pj6

WordPress Authentication Bypass Wordpress Plugin Appointment Bookings For Zoom Googlemeet And More Wappointment

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Unauthenticated network REST endpoints with no secret in key derivation; all inputs are observable or enumerable; integrity-only impact with no code execution or data exposure.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 10:22 vuln.today

CVE Published

Jul 02, 2026 - 08:33 cve.org

MEDIUM 5.3

DescriptionCVE.org

The Appointment Bookings for Zoom GoogleMeet and more - Wappointment plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 2.7.6 via the appointmentkey parameter due to the appointment edit_key - the sole authorization token consumed by tryCancel() - being generated as a predictable, unsalted MD5 hash of only client_id (a sequential integer), start_at (a publicly observable appointment timestamp), and staff_id (a small enumerable integer), with no secret salt or random component, and the unauthenticated cancellation and rescheduling REST endpoints performing no ownership or identity verification beyond matching this reconstructible key. This makes it possible for unauthenticated attackers to compute valid edit_key values for appointments belonging to other users and cancel or reschedule those appointments arbitrarily. Exploitation requires the allow_cancellation or allow_rescheduling setting to be enabled on the site, both of which are common configurations for active booking deployments; an attacker can obtain the inputs needed to reconstruct a victim's key by booking their own appointment to observe their sequential client_id and correlating publicly visible appointment times and enumerable staff identifiers.

AnalysisAI

Unauthenticated appointment cancellation and rescheduling in the Wappointment WordPress plugin (all versions ≤ 2.7.6) is possible because the sole authorization token - the edit_key - is a predictable, unsalted MD5 hash of three fully derivable inputs: a sequential integer client_id, a publicly observable appointment timestamp start_at, and an enumerable integer staff_id. The unauthenticated REST endpoints for tryCancel() perform no ownership or identity verification beyond matching this reconstructible key, meaning any network attacker who books one appointment can calibrate the sequential ID space and compute valid keys for other users' appointments. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, but the attack requires only standard HTTP tooling and basic scripting against any site with cancellation or rescheduling features enabled.

Technical ContextAI

The affected product, identified by CPE cpe:2.3:a:wappointment:appointment_bookings_for_zoom_googlemeet_and_more_-_wappointment:*:*:*:*:*:*:*:*, is a WordPress scheduling plugin integrating with Zoom, Google Meet, and similar platforms. The root cause is CWE-639 (Authorization Through User-Controlled Key): the edit_key is derived exclusively as MD5(client_id + start_at + staff_id) with no secret salt or random nonce injected at any stage. Source code evidence is visible in the plugin trac at AppointmentNew.php (lines 40, 190, 347) and Client.php (line 39) for both version 2.7.5 and 2.7.6. Because client_id is a sequential auto-increment integer, start_at is exposed through booking confirmations or public calendars, and staff_id is a small enumerable set exposed via the booking UI, an attacker can preimage any edit_key without knowing any secret. The unauthenticated REST endpoints for cancellation and rescheduling validate only that the submitted key matches the stored hash, with no session, nonce, or identity check.

RemediationAI

Update the Wappointment plugin to the first release above version 2.7.6 that incorporates changeset 3546313 from the WordPress plugin SVN repository; consult the plugin changelog at wordpress.org/plugins/wappointment/#developers to confirm the patched version number, as the exact release version was not independently confirmed in available intelligence. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/07069f39-f892-4c19-8e0b-e5e17b1ffb21 should be monitored for patch version confirmation. As an immediate compensating control for sites that cannot update, disable the allow_cancellation and allow_rescheduling settings within the plugin configuration - note this removes self-service cancellation and rescheduling for legitimate customers, which may be operationally disruptive for active booking businesses. Adding rate-limiting to the appointment REST API endpoints can reduce the speed of automated enumeration but does not address the root cause of predictable key derivation and should not be treated as a sufficient standalone mitigation.