Description

The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-assistant conversation named in its unauthenticated conversation actions, allowing any unauthenticated visitor to read another visitor's assistant messages and to inject messages into their in-progress conversation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.8",
  "pubDate": "2026-09-19T07:16:33.480Z",
  "pubdate": "2026-09-19T07:16:33.480Z",
  "executiveSummary": "The Online Scheduling and Appointment Booking System WordPress plugin is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability due to insufficient authorization checks within its AI booking-assistant conversation handler.\nThis vulnerability allows unauthenticated remote attackers to access private conversation logs and manipulate the state of active AI assistant sessions belonging to other users.\nThe flaw stems from the application's failure to validate ownership of conversation identifiers during unauthenticated action requests. Consequently, an attacker can enumerate or guess conversation IDs to perform unauthorized read and write operations.\nThe impact includes full disclosure of sensitive information exchanged during scheduling, potential manipulation of appointment details, and the injection of unauthorized messages into ongoing user-assistant interactions.\nThe risk is critical for environments where the AI assistant handles personally identifiable information (PII) or sensitive booking metadata, as no authentication is required to weaponize the flaw, necessitating immediate remediation for all deployments prior to version 28.2.",
  "technicalDetails": "The vulnerability resides within the plugin's AI booking-assistant conversational interface, which fails to implement server-side access control validation when processing unauthenticated requests. The core issue is an improper authorization check wherein the system assumes that the provision of a specific conversation identifier is sufficient proof of ownership or authorization to interact with that session.\nThe root cause is the absence of a session validation layer or ownership verification mechanism in the conversation management functions. When an unauthenticated visitor initiates a request to the plugin's conversation API, the backend processes the action based solely on the provided conversation name or ID without verifying that the requester's session token or browser identifier is associated with that specific conversation instance.\nThe attack flow proceeds as follows: First, an attacker identifies a target conversation ID through traffic interception, brute-force enumeration, or by observing sequential ID patterns. Second, the attacker crafts a malicious request targeting the plugin's exposed conversation API endpoints. Because the plugin lacks proper authorization checks, it interprets these requests as legitimate interactions with the target session.\nBy manipulating the parameters in the HTTP request, the attacker can retrieve the full message history of any victim's conversation, facilitating a breach of data confidentiality. Furthermore, the vulnerability allows for message injection, where the attacker transmits arbitrary text into the conversation stream. This can be used to influence the AI assistant's responses, mislead users during the scheduling process, or potentially exfiltrate session-specific information by tricking the AI assistant into divulging data through crafted prompts.\nThe exploitation is performed over the network without requiring any prior authentication, making the attack surface significantly broad for public-facing WordPress installations. Since the plugin is designed for unauthenticated user interaction, the lack of rigorous ownership verification renders the entire AI communication channel insecure by default. Version 28.2 introduces the necessary security controls to enforce ownership checks, thereby neutralizing the IDOR vector by validating the requester's identity against the session record in the backend database."
}