CVE-2026-5693
Unauthenticated Booking Cancellation in Smart Appointment & Booking WordPress Plugin
Publication date: 2026-05-12
Last updated on: 2026-05-12
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| zealousweb | smart_appointment_booking | to 1.0.8 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Smart Appointment & Booking plugin for WordPress has a vulnerability due to a missing capability check and a flaw in the nonce validation logic within the saab_cancel_booking() function. Specifically, the nonce check uses a logical AND (&&) instead of OR (||), which causes the security check to be bypassed if any value is provided for the security parameter.
This flaw allows unauthenticated attackers to cancel arbitrary bookings by supplying a predictable booking ID, effectively enabling unauthorized modification of booking data.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers who are not logged in to cancel any booking in the system without permission. This unauthorized modification can disrupt business operations, cause loss of trust from customers, and potentially lead to financial or reputational damage.
What immediate steps should I take to mitigate this vulnerability?
The Smart Appointment & Booking plugin for WordPress has been temporarily closed and is no longer available for download as of May 6, 2026.
As an immediate mitigation step, you should uninstall or deactivate the Smart Appointment & Booking plugin (version 1.0.8 or earlier) from your WordPress installation to prevent exploitation of the vulnerability.
Monitor the official plugin page for updates or a patched version after the full review is completed.