CVE-2026-9830

BookingPress Pro < 5.7.3 - Unauthenticated Customer PII Disclosure and Booking Tampering via Permission Callback Bug

The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other users' bookings.

Affected

bookingpress-appointment-booking-pro

CVSS v3.1 CNA

8.2 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

EPSS

0.43% chance of exploitation in the next 30 days, 36th percentile

Published

2026-07-27

Proof-of-concept exploits (3)

• https://wpscan.com/vulnerability/5fded411-52fd-4dc5-9a23-b77fcd9cfed2/
• ChPratik/CVE-2026-98300★ · 2026-07-27
• opaxial/CVE-2026-9830477★ · 2026-08-20

References

• CVE Record
• NVD entry

Related

• CVE-2026-50522
• CVE-2026-54121