CVE-2026-39756
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Wappointment plugin in versions up to and including 2.7.7 contains an Insecure Direct Object References (IDOR) vulnerability that allows an unauthenticated attacker to access resources they should not have permission to.
Risk Assessment
An unauthenticated attacker could access other users' data or functions, potentially leading to information disclosure or unauthorized actions within the booking system.
Recommendation
Update the Wappointment plugin to a version newer than 2.7.7 that fixes the IDOR vulnerability.
Other vulnerabilities in Wappointment
See all- CVE-2026-9188Medium
The Wappointment plugin for WordPress up to version 2.7.6 contains an Insecure Direct Object Reference (IDOR) vulnerability. The authorization key `edit_key` is generated as a predictable, unsalted MD5 hash of a sequential client ID, a publicly observable timestamp, and a small staff ID, allowing unauthenticated attackers to compute it and cancel or reschedule other users' appointments.
- CVE-2025-68575Medium
Missing Authorization vulnerability in Wappointment team Wappointment allows exploiting incorrectly configured access control security levels. This issue affects Wappointment through <= 2.7.6.
Original NVD description (English source)
Unauthenticated Insecure Direct Object References (IDOR) in Wappointment <= 2.7.7 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS