Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-86475

Appointment Hour Booking < 1.5.95 - Unauthenticated Booking Capacity Bypass via Multi-Appointment Submission

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The Appointment Hour Booking WordPress plugin before 1.5.95 does not check every appointment in a booking submission against the capacity configured for its own slot, allowing unauthenticated visitors to take slots that are already fully booked.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown Appointment Hour Booking

Default version status: unaffected

  • 0 to < 1.5.95affected

References