2983 matches found
EUVD-2026-69868
The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an...
CVE-2026-15232: Authorization Bypass Through User-Controlled Key
The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an...
PT-2026-84606
The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an...
PT-2026-84719
The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members...
CVE-2026-77704
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their ow...
CVE-2026-76586
The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment, allowing unauthenticated users to have a paid appointment approved for a...
EUVD-2026-68058
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their ow...
CVE-2026-77704 Amelia 1.2.32 - 2.4.8 - Amelia Customer+ Appointment Status Update and Self-Approval
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their ow...
CVE-2026-77704 Amelia 1.2.32 - 2.4.8 - Amelia Customer+ Appointment Status Update and Self-Approval
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their ow...
CVE-2026-77704
The Booking for Appointments and Events Calendar WordPress plugin (versions 1.2.32-2.4.8 ) is vulnerable to an incorrect authorization issue. The plugin fails to verify if a user possesses the required capabilities before allowing them to modify an appointment's status. This flaw enables customer...
EUVD-2026-68053
The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment, allowing unauthenticated users to have a paid appointment approved for a...
PT-2026-83410
Name of the Vulnerable Software and Affected Versions Booking for Appointments and Events Calendar versions prior to 2.4.9 Description Insufficient capability checks allow users to modify the status of appointments they are booked on. This enables customers to set arbitrary statuses, such as...
CVE-2026-77704: Incorrect Authorization
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their ow...
PT-2026-83405
Name of the Vulnerable Software and Affected Versions Appointment Booking Calendar Plugin and Scheduling Plugin versions prior to 1.6.3 Description This issue occurs when the plugin fails to verify the actual amount paid against the server-side price staged for a booking during the confirmation o...
CVE-2026-76586: Improper Access Control
The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment, allowing unauthenticated users to have a paid appointment approved for a...
WordPress Appointment Hour Booking plugin < 1.5.88 - Unauthenticated Booking Price Manipulation via tcost Parameter vulnerability
Unauthenticated Booking Price Manipulation via tcost Parameter vulnerability discovered by Researcher1: Alessandro Greco aka Aleff; Researcher2: Giovambattista Ianni; Company/Organization: University of Calabria UNICAL in WordPress Plugin Appointment Hour Booking versions 1.5.88...
WordPress KiviCare plugin < 4.5.4 - Patient+ Cross-Patient Appointment Modification via IDOR vulnerability
Patient+ Cross-Patient Appointment Modification via IDOR vulnerability discovered by Erwan LR WPScan in WordPress Plugin KiviCare versions 4.5.4...
WordPress TrueBooker Appointment Booking plugin < 1.2.7 - Unauthenticated Appointment and Payment Record Deletion via update_appointment_booked vulnerability
Unauthenticated Appointment and Payment Record Deletion via updateappointmentbooked vulnerability discovered by Erwan LR WPScan in WordPress Plugin TrueBooker versions 1.2.7...
CVE-2026-68566
Unauthenticated SQL Injection in BookingPress Appointment Booking Pro = 6.0.2 versions...
Malicious Package
Overview hubert-appointment-v2-task-create-am is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization a...