BookingPress Pro REST routes expose and alter customer bookings
BookingPress Appointment Booking Pro before 5.7.3 fails to invoke the permission callback correctly for every route in one REST API namespace. An unauthenticated attacker can therefore reach those routes without a WordPress account, read customer booking data and modify bookings belonging to other users. The CNA record does not identify the affected namespace, route names, request parameters or callback function.
- Component
- bookingpress-appointment-booking-pro
- Plugin slug
bookingpress-appointment-booking-pro- Affected
- < 5.7.3
- Safe version
5.7.3- Published
- Jul 27, 2026
This CVE was published Jul 27, 2026 and is one of 2 known issues for this plugin.
Update, patch or deactivate.
Update BookingPress Appointment Booking Pro to 5.7.3 or later. Review booking changes and access logs from the period when a vulnerable release was publicly reachable, and treat exposed customer booking data according to the site's incident-response requirements.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other users' bookings.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N