Appointment Hour Booking EUVD-2026-54731

No special conditions are required for exploitation - any unauthenticated visitor can submit a crafted booking form request against a default installation of Appointment Hour Booking running any version before 1.5.88 where at least one paid service is configured. The attack requires only the ability to intercept and modify an outbound HTTP booking request, achievable via browser developer tools, Burp Suite, or the published WPScan PoC. CVSS metrics AV:N/AC:L/PR:N/UI:N confirm no authentication, no network restriction, and no special configuration is required. Exploitation is limited to sites where the plugin is actively used to process paid bookings; installations used purely for free appointment inquiry are not exposed to financial integrity impact, though booking record corruption remains possible. The attack does not require any existing account, session, or knowledge of the target site beyond the existence of a bookable paid service.

The CVSS 5.3 medium score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately reflects the trivial access conditions but the I:L rating likely understates real-world business impact - the ability to set prices to zero or negative completely undermines the financial integrity of any site charging for appointments, which is a more severe outcome than 'limited' integrity modification implies. EPSS at 0.14% (3rd percentile) confirms low observed exploitation probability in the wild, and the absence of a CISA KEV listing means no confirmed active exploitation campaign. However, a publicly available PoC via WPScan lowers the skill bar to near zero. The CWE-287 (Improper Authentication) assignment may cause miscategorization in vulnerability management tools that triage by CWE, since this is fundamentally a business logic/input validation flaw - security teams should not dismiss it based on CWE alone. The practical financial risk for any operator processing paid bookings exceeds what the raw CVSS score communicates, particularly in the absence of a downstream payment gateway that independently enforces expected charge amounts.

An unauthenticated attacker visits a WordPress site running Appointment Hour Booking before 1.5.88, initiates a booking for a paid service, and uses a browser proxy or the published WPScan PoC to modify the price parameter in the HTTP request to zero before submission. The server processes and stores the attacker-supplied price as authoritative - with no server-side validation performed - resulting in a confirmed free booking that corrupts the payment record. The publicly available exploit code makes this attack reproducible with minimal technical skill.