Appointment Booking Calendar EUVD-2026-28236

Exploitation requires the Appointment Booking Calendar plugin (version up to 1.6.10.6) to be installed and activated on a WordPress site with the REST API enabled (default configuration). No user interaction is required. The REST API endpoints (/wp-json/ssa/v1/*) must be publicly accessible, which is the default for WordPress unless explicitly blocked by web server configuration. The public_nonce is embedded in the HTML or exposed via the /wp-json/ssa/v1/embed-inner endpoint to unauthenticated users, so no authentication is needed to obtain it. The plugin's use of a static, site-wide nonce (rather than user-specific or request-specific nonces) is the core condition enabling exploitation-if the nonce were user-bound or appointment-specific, the attack would fail. No special WordPress configuration, custom capabilities, or appointment-specific properties are required; the vulnerability affects all appointments regardless of their visibility or ownership. Attack succeeds against default WordPress installations without additional hardening.

This vulnerability represents a significant real-world risk despite the CVSS 6.5 score (moderate). The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U) indicates network-accessible, low-complexity, unauthenticated, no-user-interaction exploitation-all negative signals pointing to ease of abuse. However, CVSS impact ratings show I:L and A:L (low integrity and availability impact), which may understate the actual business risk: complete unauthorized access to all appointment records (view, modify, delete) represents high integrity compromise and significant availability risk for booking systems. The vulnerability is not listed as confirmed actively exploited (no KEV status provided), but Wordfence discovery and public code references suggest awareness in the security community. Real-world risk is elevated because the exploitation is trivial: attackers need only fetch the public nonce from an unauthenticated endpoint and replay it in DELETE/modify requests-no complex bypasses required. The lack of user-specificity or appointment-specificity in the nonce makes bulk attacks feasible. Organizations running this plugin in production with customer appointment data should treat this as high priority despite the moderate CVSS score. Sites relying on appointment bookings for revenue face direct business impact (data loss, service disruption, customer trust erosion).

An attacker discovers a WordPress site using the vulnerable Appointment Booking Calendar plugin. They send an unauthenticated HTTP GET request to /wp-json/ssa/v1/embed-inner, extract the site-wide public_nonce value from the JSON response, and craft a DELETE request to /wp-json/ssa/v1/appointments/12345/delete with the X-PUBLIC-Nonce header set to the extracted nonce and X-WP-Nonce header set to any arbitrary value. The plugin's nonce_permissions_check() method rejects the invalid X-WP-Nonce, then falls back to validating X-PUBLIC-Nonce, which succeeds because the public nonce is valid and site-wide. The appointment is deleted without authentication. The attacker can repeat this for all appointment IDs (enumeration is trivial if IDs are sequential) to wipe the appointment database or exfiltrate data by querying /wp-json/ssa/v1/appointments/{id} endpoints with the same public nonce.