CVE-2026-6723
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to and including 1.6.11.11 due to the appointment update REST API endpoint not restricting which fields can be modified by token-authenticated customers. This allows unauthenticated attackers to modify admin-controlled fields on that appointment, including faking payment confirmation, reassigning the appointment to another user, and changing the service type.
Risk Assessment
The risk includes the possibility of manipulating appointments, which could lead to fake payment confirmations, unauthorized schedule changes, or data integrity breaches. This can affect customer trust and cause financial losses.
Recommendation
Immediately update the Appointment Booking Calendar plugin to the latest patched version. Also restrict API access and regularly monitor booking logs for suspicious changes.
Other vulnerabilities in Appointment Booking Calendar
See all- CVE-2026-13358Medium
The Appointment Booking Calendar plugin for WordPress up to version 1.6.12.10 is vulnerable to Insecure Direct Object Reference via the ssa_past_appointments parameter due to missing validation on a user-controlled key. Authenticated attackers with contributor-level access can access appointment records of arbitrary users, including ownership tokens and full customer PII. The REST endpoint is registered unconditionally and only requires edit_posts capability.
- CVE-2026-12113Medium
The Appointment Booking Calendar plugin for WordPress up to version 1.4.02 exposes sensitive information via the cpabc_appointments_filter_list parameter. This allows authenticated attackers with contributor-level access or higher to extract customer personal identifiable information such as names, email addresses, phone numbers, appointment comments, and other booking details.
- CVE-2025-13317Medium
The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.3.96. The plugin exposes an unauthenticated booking processing endpoint (cpabc_appointments_check_IPN_verification) that trusts attacker-supplied payment notifications without verifying their origin, authenticity, or requiring proper authorization checks. Unauthenticated attackers can arbitrarily confirm bookings and insert them into the live calendar via the 'cpabc_ipncheck' parameter, triggering administrative and customer notification emails and disrupting operations.
- CVE-2025-64261Medium
The Appointment Booking Calendar plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 1.3.95.
Original NVD description (English source)
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 1.6.11.11. This is due to the appointment update REST API endpoint not restricting which fields can be modified by token-authenticated customers. This makes it possible for unauthenticated attackers to modify admin-controlled fields on that appointment, including faking payment confirmation, reassigning the appointment to another user, and changing the service type.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS