Vulnerability · Published Jul 27, 2026 · Assigned by WPScan

CVE-2026-9830BookingPress Pro < 5.7.3 - Unauthenticated Customer PII Disclosure and Booking Tampering via Permission Callback Bug

High 8.2

In plain English

A high-severity improper authentication in bookingpress-appointment-booking-pro from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.4%top 62.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other users' bookings.

Affected products (as reported)

Vendor	Product	Versions
Unknown	bookingpress-appointment-booking-pro	0 – before 5.7.3

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

References

https://wpscan.com/vulnerability/5fded411-52fd-4dc5-9a23-b77fcd9cfed2/ exploit, vdb-entry, technical-description