Appointment Booking Plugin EUVD-2026-94769

Requires an authenticated WordPress backend account holding a record-scoped staff role provided by the Appointment Booking Plugin (PR:H) - the vulnerable deletion operation fails to check that the staff user is authorized for the specific targeted record. Exploitation is network-reachable with no user interaction and works against standard configurations where scoped staff roles are in use. The principal limiting factor is the staff-account prerequisite: an attacker must already possess (or compromise) a backend staff login, so there is no path for a fully unauthenticated or self-service-customer actor. Affects versions before 5.6.5; patched builds verify record ownership.

Signals point to a genuinely low-priority issue rather than an urgent one, consistent with the vendor's 2.7 CVSS score. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) shows a network-reachable, low-complexity flaw with no user interaction, but it requires high privileges (PR:H) - specifically an existing authenticated backend staff account - which sharply constrains the threat population to malicious or compromised insiders. No EPSS score, KEV listing, or POC was provided in the input, so there is no evidence of active or probable exploitation; exploitation status is best characterized as no public exploit identified at time of analysis. The one notable tension: the vendor rated impact as I:L / A:N, yet the description states an attacker can IRREVERSIBLY delete ANY order, customer, or transaction across the whole site, which is a substantial integrity (and arguably availability) impact that I believe understates real harm - see assessed_cvss_vector. SSVC-style framing: exploitation none, automatable no (requires authenticated staff context and target record IDs), technical impact partial-to-total for data destruction. Net: low widespread risk, but meaningful insider-abuse and over-privileged-staff risk for sites that delegate scoped staff roles.

A business grants a limited, record-scoped staff account (e.g., a single-location receptionist) to the WordPress site running the Appointment Booking Plugin. Because the plugin does not verify that the staff user owns or is scoped to the targeted record, that user sends a deletion request referencing a record ID outside their scope and permanently removes another staff member's orders, customers, or transactions. No public exploit code was identified in the provided data; the issue was reported by WPScan.