EUVD-2026-83509
GHSA-mj5r-8jcf-67xr
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Unauthenticated remote (PR:N/AV:N) but AC:H because attacker must obtain another visitor's live conversation ID; impact limited to reading (C:L) and injecting (I:L) chat messages, no availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-assistant conversation named in its unauthenticated conversation actions, allowing any unauthenticated visitor to read another visitor's assistant messages and to inject messages into their in-progress conversation.
AnalysisAI
Unauthenticated visitors to WordPress sites running the Online Scheduling and Appointment Booking System plugin (versions 28.1 through before 28.2) can read other visitors' AI booking-assistant messages and inject new messages into their in-progress conversations, because the plugin's unauthenticated conversation actions never verify that the requester owns the conversation ID being referenced. Rated CVSS 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) under CWE-639, the practical risk hinges on how conversation identifiers are generated: if they are sequential or guessable the flaw is broadly automatable, but if they are opaque tokens exploitation is opportunistic and low-volume, which is why the base score is only moderately elevated. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation targets the plugin's unauthenticated AI booking-assistant conversation actions and requires the victim to have an in-progress assistant conversation whose identifier the attacker can reference; no authentication and no user interaction are needed on the attacker side (PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely LOW-to-MODERATE priority issue despite carrying a real CVSS 4.8. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to update the Online Scheduling and Appointment Booking System WordPress plugin to version 28.2 or later - vendor patch: 28.2 - which adds the missing ownership verification on the unauthenticated AI booking-assistant conversation actions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today