high8.2
CVE-2026-9830
The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of it…
Impact
The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other users' bookings.
Affected products
| Product | Affected versions |
|---|---|
| Bookingpress-Appointment-Booking-Pro WordPress Plugin | before 5.7.3 |
Versions were read from the advisory text. No structured product data has been published for this record yet.