WordPress Appointment Hour Booking plugin < 1.5.95 - Unauthenticated Booking Capacity Bypass vulnerability

Unauthenticated Booking Capacity Bypass vulnerability discovered by Nicat in WordPress Plugin Appointment Hour Booking versions 1.5.95...

CVE-2026-86475

The Appointment Hour Booking WordPress plugin before 1.5.95 does not check every appointment in a booking submission against the capacity configured for its own slot, allowing unauthenticated visitors to take slots that are already fully booked...

CVE-2026-86475

Appointment Hour Booking is a WordPress plugin that allows scheduling of time-based appointments. Versions prior to 1.5.95 are affected by a capacity validation flaw: when a multi-appointment booking submission is received, the plugin does not verify each individual appointment against the capaci...

CVE-2026-86475 Appointment Hour Booking < 1.5.95 - Unauthenticated Booking Capacity Bypass via Multi-Appointment Submission

The Appointment Hour Booking WordPress plugin before 1.5.95 does not check every appointment in a booking submission against the capacity configured for its own slot, allowing unauthenticated visitors to take slots that are already fully booked...

CVE-2026-86475 Appointment Hour Booking < 1.5.95 - Unauthenticated Booking Capacity Bypass via Multi-Appointment Submission

The Appointment Hour Booking WordPress plugin before 1.5.95 does not check every appointment in a booking submission against the capacity configured for its own slot, allowing unauthenticated visitors to take slots that are already fully booked...