Authorization Flaw in Appointment Booking Calendar Plugin for WordPress

CVE-2026-6723

What is CVE-2026-6723?

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress contains a significant security vulnerability that allows unauthenticated attackers to exploit the appointment update REST API endpoint. This flaw enables the modification of admin-controlled fields by users with a token, without proper authorization. Attackers can manipulate critical data, such as faking payment confirmations, transferring appointments between users, and altering service types, which poses a severe risk to the integrity of appointment management systems.

References