CVE-2025-13317
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.3.96. The plugin exposes an unauthenticated booking processing endpoint (cpabc_appointments_check_IPN_verification) that trusts attacker-supplied payment notifications without verifying their origin, authenticity, or requiring proper authorization checks. Unauthenticated attackers can arbitrarily confirm bookings and insert them into the live calendar via the 'cpabc_ipncheck' parameter, triggering administrative and customer notification emails and disrupting operations.
Risk Assessment
This may lead to fake bookings, operational disruption, email spam, and potential financial or reputational damage.
Recommendation
Update the Appointment Booking Calendar plugin to a version later than 1.3.96.
Other vulnerabilities in Appointment Booking Calendar
See all- CVE-2026-6723Medium
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to and including 1.6.11.11 due to the appointment update REST API endpoint not restricting which fields can be modified by token-authenticated customers. This allows unauthenticated attackers to modify admin-controlled fields on that appointment, including faking payment confirmation, reassigning the appointment to another user, and changing the service type.
- CVE-2026-13358Medium
The Appointment Booking Calendar plugin for WordPress up to version 1.6.12.10 is vulnerable to Insecure Direct Object Reference via the ssa_past_appointments parameter due to missing validation on a user-controlled key. Authenticated attackers with contributor-level access can access appointment records of arbitrary users, including ownership tokens and full customer PII. The REST endpoint is registered unconditionally and only requires edit_posts capability.
- CVE-2026-12113Medium
The Appointment Booking Calendar plugin for WordPress up to version 1.4.02 exposes sensitive information via the cpabc_appointments_filter_list parameter. This allows authenticated attackers with contributor-level access or higher to extract customer personal identifiable information such as names, email addresses, phone numbers, appointment comments, and other booking details.
- CVE-2025-64261Medium
The Appointment Booking Calendar plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 1.3.95.
Original NVD description (English source)
The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.96. This is due to the plugin exposing an unauthenticated booking processing endpoint (cpabc_appointments_check_IPN_verification) that trusts attacker-supplied payment notifications without verifying their origin, authenticity, or requiring proper authorization checks. This makes it possible for unauthenticated attackers to arbitrarily confirm bookings and insert them into the live calendar via the 'cpabc_ipncheck' parameter, triggering administrative and customer notification emails and disrupting operations.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS