CVE-2026-9830
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The bookingpress-appointment-booking-pro WordPress plugin before version 5.7.3 incorrectly implements its REST permission callback. This allows unauthenticated attackers to access API routes, read customer booking data, and modify other users' bookings.
Risk Assessment
An attacker can access sensitive customer data and manipulate bookings, leading to privacy and data integrity breaches.
Recommendation
Update the bookingpress-appointment-booking-pro plugin to version 5.7.3 or later, which includes a fix for the REST permission check.
Other vulnerabilities in bookingpress-appointment-booking-pro
See all- CVE-2026-68566Critical
Unauthenticated SQL Injection vulnerability in the BookingPress Appointment Booking Pro plugin. Affects versions up to 6.0.2.
- CVE-2026-11823High
The BookingPress Appointment Booking Pro plugin for WordPress up to version 5.7.1 is vulnerable to SQL Injection via the 'store_service_date' parameter in the bpa_assign_staffmember_to_slots() function. This is due to the use of stripslashes_deep() on POST data without using $wpdb->prepare(), allowing unauthenticated attackers to append additional SQL queries.
Original NVD description (English source)
The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other users' bookings.