8 matches found
CVE-2026-108758
Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register that allows unauthenticated attackers to modify any appointment by supplying an appointment id without its hash. Attackers can enumerate sequential appointment ids with a self-asserted managemode...
CVE-2026-108758
Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register that allows unauthenticated attackers to modify any appointment by supplying an appointment id without its hash. Attackers can enumerate sequential appointment ids with a self-asserted managemode...
EUVD-2026-96923
Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register that allows unauthenticated attackers to modify any appointment by supplying an appointment id without its hash. Attackers can enumerate sequential appointment ids with a self-asserted managemode...
CVE-2026-108758
Easy!Appointments versions through 1.6.0 are vulnerable to an authorization bypass within the Booking::register() function. This flaw allows unauthenticated attackers to modify any appointment by providing an appointment ID without the required hash. By enumerating sequential IDs and self-asserti...
CVE-2026-108758 Easy!Appointments through 1.6.0 Authorization Bypass via booking/register Endpoint
Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register that allows unauthenticated attackers to modify any appointment by supplying an appointment id without its hash. Attackers can enumerate sequential appointment ids with a self-asserted managemode...
CVE-2026-108758 Easy!Appointments through 1.6.0 Authorization Bypass via booking/register Endpoint
Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register that allows unauthenticated attackers to modify any appointment by supplying an appointment id without its hash. Attackers can enumerate sequential appointment ids with a self-asserted managemode...
PT-2026-110160
Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register that allows unauthenticated attackers to modify any appointment by supplying an appointment id without its hash. Attackers can enumerate sequential appointment ids with a self-asserted manage mode...
CVE-2026-4807
CVE-2026-4807 affects the WordPress plugin “Appointment Booking Calendar” (publicly exposed at WordPress.org) up to version 1.6.10.6. The root cause is missing authorization caused by flawed logic in nonce_permissions_check() combined with a site-wide public nonce exposed via /wp-json/ssa/v1/embe...