CVE-2026-66679 MEDIUM

CVE-2026-66679: WordPress Appointment Hour Booking plugin <= 1.5.91 - Broken Access Control vulnerability

Vendor Codepeople
Product Appointment Hour Booking
Weakness CWE-1284
Published August 18, 2026
Last update August 18, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

Unauthenticated Broken Access Control in Appointment Hour Booking <= 1.5.91 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Appointment Hour Booking versions up to 1.5.91 do not properly validate the quantity of input data, allowing an attacker to send malformed requests that corrupt data or degrade site performance. No authentication is required. The vulnerability affects data integrity and availability but not confidentiality.

What an attacker can do

03Attacker Capabilities

Send specially crafted requests to corrupt appointment data or cause the site to become slow or unresponsive.

Potential impact on your site

04Site Impact

Appointment bookings may be corrupted, lost, or cause performance degradation without warning.

Conditions required to exploit

05Prerequisites

Network access to the site; no authentication or user interaction required.

Key dates

06Disclosure timeline

August 18, 2026 CVE published
August 18, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-57623 WordPress W3 Total Cache plugin <= 2.9.4 - Arbitrary Code Execution vulnerability CVE-2024-24715 WordPress WordPress BookIt Plugin plugin <= 2.4.0 - Price Bypass Vulnerability vulnerability CVE-2025-49292 WordPress Profile Builder plugin <= 3.13.8 - Content Spoofing Vulnerability CVE-2026-42657 WordPress Contest Gallery plugin <= 28.1.7 - Other Vulnerability Type vulnerability CVE-2022-4171 demon image annotation <= 5.0 - Improper Input Restriction Validation