EUVD-2026-50997
GHSA-v6g6-7m7c-3mx6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Public booking endpoint requires no authentication (PR:N, AV:N); impact is limited to integrity via workflow bypass with no confidentiality or availability consequence.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Appointment Booking Plugin WordPress plugin before 5.6.8 does not restrict which booking fields an unauthenticated visitor can set through its public booking funnel, allowing an unauthenticated user to assign a privileged booking field such as the approval status and thereby bypass the site's booking approval workflow.
AnalysisAI
The Appointment Booking Plugin for WordPress (all versions before 5.6.8) allows unauthenticated visitors to set privileged booking fields - including approval status - through the plugin's public booking funnel, silently bypassing the site's manual booking approval workflow. Any site relying on appointment approval as a gatekeeping mechanism can have that control subverted by any internet-accessible visitor with no credentials required. A publicly available proof-of-concept exists per WPScan; however, EPSS remains at 0.15% (5th percentile), indicating limited observed exploitation activity despite the trivially low attack complexity.
Technical ContextAI
The root cause is CWE-284 (Improper Access Control) - specifically, a failure to apply server-side field-level authorization on the public booking submission endpoint. The affected product is identified via CPE cpe:2.3:a:unknown:appointment_booking_plugin:*:*:*:*:*:*:*:* on WordPress. The plugin's booking funnel is intentionally public-facing to allow visitor bookings, but it does not distinguish between fields a visitor is permitted to set (name, time, contact details) and fields that should be restricted to administrators or internal workflow logic (such as approval_status). This is a classic mass assignment or insufficient authorization vulnerability at the API/form-processing layer - the server accepts and persists whatever fields are submitted without checking the caller's privilege level against each field's sensitivity.
RemediationAI
The primary fix is to update the Appointment Booking Plugin to version 5.6.8 or later, which is the vendor-released patch confirmed by WPScan (https://wpscan.com/vulnerability/2609e202-9be3-42b0-a1fb-ace310b93bd0/). Update via the WordPress admin dashboard under Plugins > Updates, or use wp-cli with 'wp plugin update'. If immediate patching is blocked, a short-term compensating control is to temporarily disable the plugin's public booking form, which eliminates the attack surface but also disrupts legitimate appointment booking. A WAF rule that strips unexpected or privileged fields (e.g., approval_status) from booking POST requests can reduce exposure, though effectiveness depends entirely on knowing the exact field names the plugin exposes - consult the POC for field enumeration. Sites that do not use the booking approval workflow feature are not exposed to the practical risk of this vulnerability. No side effects beyond brief booking disruption are expected from upgrading to 5.6.8.
More in Appointment Booking Plugin
View allSame weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today