EUVD-2026-57727
GHSA-mhjw-fw4w-ff4c
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
PR:L required because exploitation demands authenticated employee access; AC:L because appointment ID enumeration imposes no meaningful complexity barrier.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
4DescriptionCVE.org
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee (provider) is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data.
AnalysisAI
Broken object-level authorization in the Booking for Appointments and Events Calendar WordPress plugin (versions before 2.4.6) allows any authenticated employee or provider account to read appointment records they are not assigned to, exposing booked customers' personal data. The vulnerability is a classic IDOR (CWE-639): the plugin fetches appointment details by a caller-controlled identifier without verifying the requesting employee is the one assigned to that appointment. No active exploitation has been confirmed (not in CISA KEV), and EPSS places this at the 3rd percentile, reflecting limited real-world exploitation pressure, though the PII disclosure impact is concrete.
Technical ContextAI
The vulnerability is rooted in CWE-639 (Authorization Through User-Controlled Key), a form of Insecure Direct Object Reference (IDOR) within a multi-role WordPress plugin that manages appointment booking. The plugin implements an employee/provider role distinct from administrators and customers. When an employee queries an appointment record using its identifier, the application retrieves and returns the record without confirming that the querying employee is the assigned provider for that appointment. Affected CPE: all releases of the 'Booking for Appointments and Events Calendar' WordPress plugin prior to version 2.4.6. The WordPress plugin ecosystem adds inherent surface area risk due to the wide variety of role and capability configurations across site deployments.
RemediationAI
Update the Booking for Appointments and Events Calendar WordPress plugin to version 2.4.6 or later, which introduces proper authorization checks verifying that the requesting employee is assigned to the queried appointment. The patch is confirmed available per vendor advisory (reported via WPScan at https://wpscan.com/vulnerability/30015f96-2771-493e-96d7-9067996e1531/). If immediate patching is not feasible, a compensating control is to audit and restrict employee account creation, ensuring only fully trusted internal staff hold the employee/provider role - this reduces the risk of a malicious employee exploiting the flaw, though it does not eliminate the vulnerability. Note that this workaround does not protect against a compromised employee account. No network-layer blocking is practical since the vulnerable endpoint serves legitimate booking functions.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today