CVE-2026-9830

The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other users' bookings.

CVSS v3.1

8.2 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

EPSS

0.37% chance of exploitation in the next 30 days, 30th percentile

Published

2026-07-27

Proof-of-concept exploits (3)

• https://wpscan.com/vulnerability/5fded411-52fd-4dc5-9a23-b77fcd9cfed2/
• ChPratik/CVE-2026-98300★ · 2026-07-27
• opaxial/CVE-2026-9830399★ · 2026-08-20

References

• CVE Record
• NVD entry

Related

• CVE-2026-50522
• CVE-2026-54121
• CVE-2026-9822
• CVE-2026-9833
• CVE-2026-9815
• CVE-2026-9848