VULNERABILITY INTELLIGENCE
CVE-2026-9830
CVSS score8.2 HIGH
EPSS probability0.43%
CISA KEVNot currently listed
Published2026-07-27
Last modified2026-07-27
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Description
The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other users' bookings.
Weakness classification
- 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-287