Medium severity5.3NVD Advisory· Published Jul 30, 2026· Updated Jul 30, 2026

CVE-2026-15250

Description

The Appointment Booking Plugin WordPress plugin before 5.6.8 does not restrict which booking fields an unauthenticated visitor can set through its public booking funnel, allowing an unauthenticated user to assign a privileged booking field such as the approval status and thereby bypass the site's booking approval workflow.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Appointment Hour Booking Pluginllm-fuzzy
Range: <5.6.8

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/2609e202-9be3-42b0-a1fb-ace310b93bd0/nvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000