What is the CVSS score of EUVD-2026-57881?

EUVD-2026-57881 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of WooCommerce Appointments are affected by EUVD-2026-57881?

WooCommerce Appointments plugin versions 5.3.8 and earlier contain an unauthenticated data exposure vulnerability affecting customer booking records and personal information.

How to fix or mitigate EUVD-2026-57881?

Within 24 hours, conduct an inventory of all WordPress installations to identify WooCommerce Appointments plugin deployment and current versions. Within 7 days, implement interim protections: disable the plugin if not business-critical, configure firewall or WAF rules to restrict access to vulnerable endpoints, and enable detailed logging and monitoring of appointment-related API requests. Within 30 days, establish a patch management process to apply any released security update to all affected installations within 24 hours.

WooCommerce Appointments EUVD-2026-57881

| CVE-2026-66462 HIGH

Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)

2026-08-13 Patchstack

GHSA-vqm4-m887-hg85

WordPress Information Disclosure Wordpress Plugin Woocommerce Appointments

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network access with no complexity barrier; high confidentiality impact from PII/booking data; no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:33 vuln.today

CVE Published

Aug 13, 2026 - 13:37 cve.org

HIGH 7.5

DescriptionCVE.org

Unauthenticated Sensitive Data Exposure in WooCommerce Appointments <= 5.3.8 versions.

AnalysisAI

Sensitive data exposure in WooCommerce Appointments plugin (≤ 5.3.8) allows unauthenticated remote attackers to access confidential booking or customer information without any credentials or user interaction. Reported by Patchstack, this High-severity flaw (CVSS 7.5) requires no authentication, no special configuration, and no user interaction, making it trivially automatable by scanning tools. No public exploit code or CISA KEV listing has been identified at time of analysis, though the zero-prerequisite attack surface warrants prompt remediation.

Technical ContextAI

WooCommerce Appointments is a WordPress plugin developed by BookingWP (CPE: cpe:2.3:a:bookingwp:woocommerce_appointments) that integrates appointment scheduling with WooCommerce storefronts. The vulnerability is classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), indicating that sensitive data - likely appointment records, customer personally identifiable information, or booking metadata - is returned by a REST API endpoint, AJAX handler, or page template that fails to enforce WordPress authentication or capability checks. WordPress and WooCommerce plugins commonly register REST API routes and admin-ajax.php handlers; when these lack nonce validation or current_user_can() checks, they become accessible to any unauthenticated HTTP client, which is the root-cause pattern indicated by CWE-497 in this context.

RemediationAI

Update WooCommerce Appointments to a version beyond 5.3.8 as indicated by the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/woocommerce-appointments/vulnerability/wordpress-woocommerce-appointments-plugin-5-3-8-sensitive-data-exposure-vulnerability. The exact patched release version was not confirmed in the available intelligence data - verify the current safe version directly in the WordPress plugin repository or with BookingWP before updating. If an immediate upgrade is not feasible, apply compensating controls via a WAF rule or a WordPress security plugin (such as Wordfence or Patchstack's virtual patching module) to block unauthenticated access to the affected endpoint; note that overly broad endpoint restrictions may break public-facing booking functionality, so targeted rule scoping is advisable. Monitor WordPress plugin update channels for the patched release and prioritize deployment.