CVE-2025-13317

The WordPress plugin “Appointment Booking Calendar” is affected up to version 1.3.96 by a Missing Authorization vulnerability. An unauthenticated endpoint (cpabc_appointments_check_IPN_verification) trusts attacker-supplied payment notifications and, via the cpabc_ipncheck parameter, allows unaut...

WordPress Appointment Booking Calendar plugin <= 1.3.96 - Missing Authorization to Arbitrary Booking Confirmation via 'cpabc_ipncheck' Parameter vulnerability

Missing Authorization to Arbitrary Booking Confirmation via 'cpabcipncheck' Parameter vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan - Knight Squad in WordPress Plugin Appointment Booking Calendar versions = 1.3.96...