2 matches found
EUVD-2026-87890
The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff member, allowing authenticated attackers with a staff-level account to view, modify a...
3.8CVSS5.9AI score0.00169EPSS
SaveExploits0References1
CVE-2026-86839: Authorization Bypass Through User-Controlled Key
The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff member, allowing authenticated attackers with a staff-level account to view, modify a...
3.8CVSS5.9AI score0.00169EPSS
SaveExploits0References2
20