Unauthorized Email Sending in Booking Plugin for WordPress from Vendor WordPress

CVE-2025-12842

What is CVE-2025-12842?

The Booking Plugin for WordPress Appointments - Time Slot is impacted by a vulnerability that allows unauthenticated users to send emails through the tslot_appt_email AJAX action without proper validation. This flaw can lead to unauthorized sending of appointment notification emails, allowing malicious actors to leverage the plugin for phishing attacks or spam distribution. It is critical for users of versions up to 1.4.7 to update their installations to mitigate the risks associated with this vulnerability.

References