Unauthorized Access Vulnerability in BookingPress Appointment Booking Pro Plugin by WordPress
CVE-2026-9830
Currently unrated
What is CVE-2026-9830?
The BookingPress Appointment Booking Pro plugin for WordPress prior to version 5.7.3 contains a vulnerability that fails to properly enforce REST API authentication. As a result, this oversight allows unauthenticated attackers to gain access to sensitive customer booking data and make unauthorized modifications to other users' bookings. This vulnerability highlights the importance of secure API design and proper permissions to safeguard user data.
Affected Version(s)
bookingpress-appointment-booking-pro 0 < 5.7.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.