CVE-2026-11866

creationtimestamp| type| source ---|---|--- 2026-07-16 07:52:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqqqwv3udz2h...

CVE-2026-11866

The Appointment Booking Plugin WordPress plugin before 5.6.3 does not validate a CSRF nonce on several state-changing actions handled by its central request dispatcher, allowing attackers to perform privileged actions, such as overwriting the booking-form configuration or disconnecting the...