What is the CVSS score of EUVD-2026-28236?

EUVD-2026-28236 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Appointment Booking Calendar EUVD-2026-28236

| CVE-2026-4807 MEDIUM

Missing Authorization (CWE-862)

2026-05-07 Wordfence

GHSA-x96p-55v7-jmrq

Authentication Bypass WordPress

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 07, 2026 - 03:15 vuln.today

CVE Published

May 07, 2026 - 02:27 nvd

MEDIUM 6.5

DescriptionCVE.org

The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.6.10.6. This is due to a flawed authorization logic in the nonce_permissions_check() method combined with the public exposure of a site-wide reusable nonce. The plugin exposes a public_nonce value through the /wp-json/ssa/v1/embed-inner endpoint, which is accessible to unauthenticated users. The appointment deletion endpoint at /wp-json/ssa/v1/appointments/{id}/delete and /wp-json/ssa/v1/appointments/bulk use a permission check that accepts requests containing both an X-WP-Nonce header (with any arbitrary value) and an X-PUBLIC-Nonce header (with the valid public nonce). When the X-WP-Nonce validation fails, the function falls back to validating the X-PUBLIC-Nonce without properly rejecting the request. Since the public_nonce is exposed to all unauthenticated visitors and is site-wide (not user-specific or appointment-specific), attackers can obtain it and use it to view details of arbitrary appointments, including the public_edit_url, or delete arbitrary appointments by ID. This makes it possible for unauthenticated attackers to view, delete or modify any appointment in the system, disclosing sensitive appointment data, causing service disruption, and loss of booking records.

AnalysisAI

Appointment Booking Calendar plugin for WordPress up to version 1.6.10.6 allows unauthenticated attackers to view, delete, and modify arbitrary appointments due to missing authorization checks in REST API endpoints. The plugin exposes a site-wide public nonce through an unauthenticated endpoint (/wp-json/ssa/v1/embed-inner), and the appointment deletion and modification endpoints (/wp-json/ssa/v1/appointments/{id}/delete and /wp-json/ssa/v1/appointments/bulk) accept requests with this public nonce even when standard WordPress nonce validation fails, bypassing authorization entirely. Attackers can enumerate and delete appointment records, disclose sensitive booking data, and disrupt services without any authentication.

Technical ContextAI

The vulnerability stems from a flawed nonce-based authorization mechanism in the plugin's REST API implementation (specifically the nonce_permissions_check() method in the TD-API-Model class). WordPress nonces are typically user-specific, request-specific tokens; however, this plugin generates a site-wide public nonce exposed via the /wp-json/ssa/v1/embed-inner endpoint to unauthenticated users. The flaw lies in a cascading validation logic where if the standard X-WP-Nonce header validation fails, the code falls back to accepting X-PUBLIC-Nonce without properly rejecting the overall request. Since the public nonce is static, site-wide, and unauthenticated, it becomes a bypass mechanism rather than a security control. The underlying root cause is CWE-862 (Missing Authorization), compounded by improper error handling and trust in a supposedly-public security token. The affected endpoints are part of the WordPress REST API route /wp-json/ssa/v1/, which is publicly accessible by default in WordPress.

RemediationAI

Update the Appointment Booking Calendar plugin immediately to version 1.6.10.7 or later, which should contain the authorization logic fix. Administrators can verify the update via the WordPress plugin dashboard or manually download from plugins.trac.wordpress.org. For organizations unable to update immediately, implement the following compensating controls: (1) restrict REST API access to /wp-json/ssa/v1/* endpoints by IP whitelist (web server configuration) if only internal or known-client access is required-this blocks unauthenticated external reconnaissance; (2) disable the plugin entirely if not actively used and re-enable only when patched; (3) monitor WordPress access logs for unusual POST/DELETE requests to /wp-json/ssa/v1/appointments endpoints from untrusted sources and alert on repeated 200/204 responses to delete operations. Note that IP whitelisting has operational overhead for multi-user or cloud-hosted environments and may block legitimate customers if the booking flow depends on REST API. Disabling the plugin stops new bookings entirely. Log monitoring is detective-only and does not prevent exploitation but enables incident response. Patching is the only complete mitigation.