CVE-2026-5693

The vulnerability exists in the saab_cancel_booking() function of the Smart Appointment & Booking plugin for WordPress versions up to 1.0.8. A missing capability check combined with a nonce validation logic flaw allows unauthorized modification of data. Specifically, the nonce check uses the && operator instead of ||, meaning that providing any value for the security parameter causes the entire check to be skipped [1].

To exploit this, an unauthenticated attacker can send a request to cancel a booking by simply supplying a predictable booking ID. No authentication is required, and the attacker does not need a valid nonce. The predictable booking IDs make it easy to enumerate and cancel multiple bookings.

The impact is that an attacker can cancel arbitrary bookings, disrupting the booking system and potentially causing loss of service for legitimate users. This could lead to reputation damage and financial loss for businesses relying on the plugin.

As of May 6, 2026, the plugin has been closed on the WordPress plugin repository pending a full review. Users are advised to remove or replace the plugin immediately.