Insecure Direct Object Reference in Wappointment WordPress Plugin

Executive Summary

The Appointment Bookings for Zoom GoogleMeet and more – Wappointment plugin for WordPress has a vulnerability called Insecure Direct Object Reference (IDOR) in all versions up to 2.7.6. This happens because the authorization token used to edit or cancel appointments, called the edit_key, is generated using a predictable and unsalted MD5 hash of only three values: client_id (a sequential number), start_at (a publicly visible appointment time), and staff_id (a small enumerable number). There is no secret or random component in this key.

Because the cancellation and rescheduling REST endpoints do not verify ownership or identity beyond matching this predictable key, an attacker can calculate valid edit_key values for other users' appointments. This allows the attacker to cancel or reschedule appointments without authentication.

To exploit this, the site must have either the allow_cancellation or allow_rescheduling setting enabled, which are common configurations. An attacker can book their own appointment to learn the sequential client_id and observe public appointment times and staff IDs to reconstruct another user's edit_key.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated attackers to cancel or reschedule appointments belonging to other users arbitrarily. This can disrupt business operations, cause loss of trust from customers, and lead to scheduling chaos.

Since attackers can manipulate appointments without authorization, it may result in denial of service for legitimate users and potential reputational damage for the organization using the plugin.

Useful 0 Not Useful 0