CVE-2026-9830 BookingPress Pro < 5.7.3 - Unauthenticated Customer PII Disclosure and Booking Tampering via Permission Callback Bug

The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other...

CVE-2026-9830

The BookingPress Appointment Booking Pro WordPress plugin (by Repute Infosystems) is vulnerable to an authentication bypass in versions before 5.7.3 . The root cause is a failure to correctly invoke the REST permission callback , making every route within one of its API namespaces accessible with...