AI Abilities API Flaw in Appointment Booking Plugin for WordPress
CVE-2026-105196

3.3LOW

Key Information:

Vendor

WordPress
Status
Appointment Booking Plugin
Vendor
CVE Published:
8 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-105196?

The Appointment Booking Plugin for WordPress, prior to version 5.6.9, contains an authorization vulnerability associated with the AI Abilities API. This flaw permits authenticated users with the LatePoint Agent role to bypass restrictions, allowing them to access, read, and even modify other agents' profile data and bookings. This unauthorized access poses significant risks, especially when sensitive customer details are involved.

Affected Version(s)

Appointment Booking Plugin 0 < 5.6.9

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-105196 - Proof of Concept

References

https://wpscan.com/vulnerability/b7b6c989-b484-4ad6-844c-...
exploitvdb-entrytechnical-description

CVSS V3.1

Score:
3.3
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Artus KG
WPScan
.