What the vulnerability does
01Description
The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.96. This is due to the plugin exposing an unauthenticated booking processing endpoint (cpabc_appointments_check_IPN_verification) that trusts attacker-supplied payment notifications without verifying their origin, authenticity, or requiring proper authorization checks. This makes it possible for unauthenticated attackers to arbitrarily confirm bookings and insert them into the live calendar via the 'cpabc_ipncheck' parameter, triggering administrative and customer notification emails and disrupting operations.
Explanation of Vulnerability in Simple Terms
02Summary
Appointment Booking Calendar versions up to 1.3.96 lack proper authorization checks, allowing unauthenticated attackers to modify appointment data. The vulnerability requires no user interaction and is remotely exploitable over the network. Site administrators should update to a version newer than 1.3.96 to prevent unauthorized changes to booking information.
What an attacker can do
03Attacker Capabilities
Modify appointment data without authentication or permission.
Potential impact on your site
04Site Impact
Attackers can alter or corrupt appointment bookings without logging in, disrupting scheduling and customer trust.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication or user interaction required.
Key dates
06Disclosure timeline
November 22, 2025
CVE published
April 8, 2026
Record updated
