CVE-2026-86475 — Appointment Hour Booking < 1.5.95 - Unauthenticated Booking Capacity Bypass via Multi-Appointment Submission
The Appointment Hour Booking WordPress plugin before 1.5.95 does not check every appointment in a booking submission against the capacity configured for its own slot, allowing u…
Published: 2026-09-16 · CVSS: 5.3 · CVSS 3.1
The Appointment Hour Booking WordPress plugin before 1.5.95 does not check every appointment in a booking submission against the capacity configured for its own slot, allowing unauthenticated visitors to take slots that are already fully booked.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7