CVEvulnerability

CVE-2026-9830

8.2 HIGH Published 2026-07-27 Modified 2026-07-27 Official page ↗
Status
Deferred
Published
2026-07-27
Last modified
2026-07-27
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
8.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Weaknesses
CWE-287

Description

The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other users' bookings.

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References