CVE-2025-68575
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Missing Authorization vulnerability in Wappointment team Wappointment allows exploiting incorrectly configured access control security levels. This issue affects Wappointment through <= 2.7.6.
Risk Assessment
Unauthorized person may gain access to functions that should be protected, potentially leading to data breach or unauthorized actions.
Recommendation
Update Wappointment to the latest version and review access control configuration.
Other vulnerabilities in Wappointment
See all- CVE-2026-39756Medium
The Wappointment plugin in versions up to and including 2.7.7 contains an Insecure Direct Object References (IDOR) vulnerability that allows an unauthenticated attacker to access resources they should not have permission to.
- CVE-2026-9188Medium
The Wappointment plugin for WordPress up to version 2.7.6 contains an Insecure Direct Object Reference (IDOR) vulnerability. The authorization key `edit_key` is generated as a predictable, unsalted MD5 hash of a sequential client ID, a publicly observable timestamp, and a small staff ID, allowing unauthenticated attackers to compute it and cancel or reschedule other users' appointments.
Original NVD description (English source)
Missing Authorization vulnerability in Wappointment team Wappointment wappointment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wappointment: from n/a through <= 2.7.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS