Account Creation Vulnerability in Advanced Appointment Booking & Scheduling Plugin by WordPress
CVE-2026-81422

Currently unrated

Key Information:

Vendor

WordPress
Status
Advanced Appointment Booking & Scheduling
Vendor
CVE Published:
9 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-81422?

The Advanced Appointment Booking & Scheduling WordPress plugin prior to version 2.7 is vulnerable due to a flaw in how it handles user registrations. It fails to check the user's registration settings before allowing account creation through a public shortcode. This oversight enables unauthenticated attackers to register arbitrary user accounts even when the site's user registration feature is turned off. Remarkably, the attackers are automatically logged in upon account creation, posing significant security risks to the affected WordPress installations.

Affected Version(s)

Advanced Appointment Booking & Scheduling 0 < 2.7

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-81422 - Proof of Concept

References

https://wpscan.com/vulnerability/05f00d47-0014-456b-ade8-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Daniel Dhaniswara
WPScan
.