{"id":"CVE-2026-9830","state":"PUBLISHED","title":"BookingPress Pro < 5.7.3 - Unauthenticated Customer PII Disclosure and Booking Tampering via Permission Callback Bug","description":"The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other users' bookings.","publishedAt":"2026-07-27T06:00:06.217Z","updatedAt":"2026-07-27T17:43:42.012Z","severity":{"score":8.2,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","source":"CISA-ADP"},"assigner":"WPScan","products":["Unknown bookingpress-appointment-booking-pro"],"affected":[{"vendor":"Unknown","product":"bookingpress-appointment-booking-pro","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.7.3","versionType":"semver"}]}],"references":["https://wpscan.com/vulnerability/5fded411-52fd-4dc5-9a23-b77fcd9cfed2/"],"weaknesses":["CWE-287"],"ingestedAt":"2026-10-29T20:13:52.441Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/9xxx/CVE-2026-9830.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-9830","state":"PUBLISHED","datePublished":"2026-07-27T06:00:06.217Z","dateUpdated":"2026-07-27T17:43:42.012Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2026-05-28T12:10:08.195Z"},"containers":{"cna":{"title":"BookingPress Pro < 5.7.3 - Unauthenticated Customer PII Disclosure and Booking Tampering via Permission Callback Bug","descriptions":[{"lang":"en","value":"The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other users' bookings."}],"affected":[{"vendor":"Unknown","product":"bookingpress-appointment-booking-pro","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.7.3","versionType":"semver"}]}],"references":[{"url":"https://wpscan.com/vulnerability/5fded411-52fd-4dc5-9a23-b77fcd9cfed2/","tags":["exploit","vdb-entry","technical-description"]}],"problemTypes":[{"descriptions":[{"description":"CWE-287 Improper Authentication","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2026-07-27T06:00:06.217Z"},"credits":[{"lang":"en","value":"Kolja Zuelsdorf","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-07-27T17:43:27.089919Z","id":"CVE-2026-9830","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-287","type":"CWE","lang":"en","description":"CWE-287 Improper Authentication"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-27T17:43:42.012Z"}}]}}}