What the vulnerability does
01Description
The Smart Appointment & Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and a nonce validation logic flaw in the saab_cancel_booking() function in all versions up to, and including, 1.0.8. The nonce check uses && (AND) instead of || (OR), which means providing any value for the security parameter causes the entire check to be skipped. This makes it possible for unauthenticated attackers to cancel arbitrary bookings by supplying a predictable booking ID.
Explanation of Vulnerability in Simple Terms
02Summary
Smart Appointment & Booking versions 1.0.8 and earlier lack proper authorization checks, allowing unauthenticated attackers to modify data through network requests. The vulnerability does not expose sensitive information or disrupt service availability, but permits unauthorized changes to appointment or booking records. Update to a version newer than 1.0.8.
What an attacker can do
03Attacker Capabilities
Modify appointment or booking data without authentication.
Potential impact on your site
04Site Impact
Attackers can alter bookings, appointments, or related records without logging in, potentially disrupting scheduling and customer data integrity.
Conditions required to exploit
05Prerequisites
Network access to the application; no authentication or user interaction required.
Key dates
06Disclosure timeline
May 12, 2026
CVE published
May 12, 2026
Record updated
