Description

Unauthenticated Broken Access Control in Appointment Hour Booking <= 1.5.91 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-18T15:16:59.827Z",
  "pubdate": "2026-08-18T15:16:59.827Z",
  "executiveSummary": "An unauthenticated broken access control vulnerability has been identified in the Appointment Hour Booking plugin, affecting all versions up to and including version 1.5.91. This security flaw allows unauthenticated remote attackers to bypass authorization mechanisms and interact with restricted functionalities or data exposures native to the application. The absence of proper access controls on sensitive endpoints creates significant risk implications, potentially leading to unauthorized data access, modification of scheduling parameters, or exposure of confidential booking information. Attackers require no prior authentication or administrative privileges to exploit this vulnerability, relying solely on network connectivity to the target WordPress installation. Exploitation conditions are trivial since the flaw is accessible without credentials, drastically lowering the attack complexity barrier for malicious actors seeking to compromise appointment workflows and underlying database integrity.",
  "technicalDetails": "The vulnerability stems from insufficient or absent access control checks within the request handling logic of the Appointment Hour Booking plugin for versions <= 1.5.91. Specifically, the vulnerable component fails to validate whether incoming HTTP requests originate from authenticated users possessing appropriate administrative or scheduling privileges before executing sensitive backend functions or returning restricted data. The root cause is rooted in missing function-level access control, where critical AJAX handlers or direct script executions rely on obscurity rather than robust session validation and capability checks. Consequently, an unauthenticated attacker can interact directly with exposed plugin endpoints over the network by crafting specific HTTP requests containing designated action parameters or function calls. The attack flow typically begins with the attacker identifying the vulnerable endpoint via source code analysis or automated scanning. Following discovery, the attacker transmits crafted HTTP GET or POST payloads directly to the target server without supplying any session tokens, cookies, or authentication headers. Because the vulnerable component lacks authorization enforcement, the application processes the request as if it were executed by a legitimate, authorized user. Depending on the specific exposed functionality, post-exploitation impact may include the unauthorized retrieval of sensitive customer booking details, disclosure of personally identifiable information, tampering with appointment slots, or unauthorized administrative configurations. The vulnerability requires zero user interaction and is exploitable over standard web protocols, presenting a critical vector for remote adversaries targeting WordPress deployments running vulnerable iterations of the Appointment Hour Booking plugin."
}