Data Exposure in Appointment Booking Plugin for WordPress
CVE-2026-105257
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 21 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-105257?
The Appointment Booking Plugin for WordPress, prior to version 5.7.5, lacks proper validation concerning authenticated agent-level users. This oversight permits an agent to access and retrieve personal data from any customer's records, including those managed by different agents. Such a flaw can lead to unauthorized disclosure of sensitive customer information, raising significant privacy concerns for users of this plugin.
Affected Version(s)
Appointment Booking Plugin 0 < 5.7.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.