CVE-2026-15250

5.3 Moyenne

Publiée le 30/07/2026 à 08:25 · Modifiée le 30/07/2026 à 17:16 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The Appointment Booking Plugin WordPress plugin before 5.6.8 does not restrict which booking fields an unauthenticated visitor can set through its public booking funnel, allowing an unauthenticated user to assign a privileged booking field such as the approval status and thereby bypass the site's booking approval workflow.

Traduire en français

Produits concernés

Unknown Appointment Booking Plugin

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.3 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N`

Faiblesses (CWE)

CWE-284

Références

https://wpscan.com/vulnerability/2609e202-9be3-42b0-a1fb-ace310b93bd0/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories