CVE-2026-5693
Received Received - Intake
Unauthenticated Booking Cancellation in Smart Appointment & Booking WordPress Plugin

Publication date: 2026-05-12

Last updated on: 2026-05-12

Assigner: Wordfence

Description
The Smart Appointment & Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and a nonce validation logic flaw in the saab_cancel_booking() function in all versions up to, and including, 1.0.8. The nonce check uses && (AND) instead of || (OR), which means providing any value for the security parameter causes the entire check to be skipped. This makes it possible for unauthenticated attackers to cancel arbitrary bookings by supplying a predictable booking ID.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-12
Last Modified
2026-05-12
Generated
2026-06-21
AI Q&A
2026-05-12
EPSS Evaluated
2026-06-20
NVD
CVE-2026-5693
EUVD
EUVD-2026-29399
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
zealousweb smart_appointment_booking to 1.0.8 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The Smart Appointment & Booking plugin for WordPress has a vulnerability due to a missing capability check and a flaw in the nonce validation logic within the saab_cancel_booking() function. Specifically, the nonce check uses a logical AND (&&) instead of OR (||), which causes the security check to be bypassed if any value is provided for the security parameter.

This flaw allows unauthenticated attackers to cancel arbitrary bookings by supplying a predictable booking ID, effectively enabling unauthorized modification of booking data.

Impact Analysis

This vulnerability can impact you by allowing attackers who are not logged in to cancel any booking in the system without permission. This unauthorized modification can disrupt business operations, cause loss of trust from customers, and potentially lead to financial or reputational damage.

Mitigation Strategies

The Smart Appointment & Booking plugin for WordPress has been temporarily closed and is no longer available for download as of May 6, 2026.

As an immediate mitigation step, you should uninstall or deactivate the Smart Appointment & Booking plugin (version 1.0.8 or earlier) from your WordPress installation to prevent exploitation of the vulnerability.

Monitor the official plugin page for updates or a patched version after the full review is completed.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-5693. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart