MEDIUM 5.3 NVD

CVE-2026-105198

The Appointment Booking Plugin WordPress plugin before 5.7.3 does not verify that the caller owns the order referenced by an order-item identifier before rende

The Appointment Booking Plugin WordPress plugin before 5.7.3 does not verify that the caller owns the order referenced by an order-item identifier before rendering that order's confirmation summary, letting an unauthenticated visitor retrieve any customer's name, contact details and order confirmation code by supplying a sequential order-item id.

References

https://wpscan.com/vulnerability/736056ca-5825-4cb7-8775-4010efe1f7cd/

Published: 2026-10-08 · Source: NVD · Feed updated: 2026-10-12

This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-10-08 via NVD.

vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.