Security Alert Summary
The Appointment Booking Plugin (versions before 5.6.3) contains a Cross-Site Request Forgery (CSRF) weakness: several state-changing actions handled by the plugin’s central request dispatcher do not validate a CSRF nonce. An attacker can induce a logged-in administrator to perform privileged actions such as overwriting the booking-form configuration or disconnecting a connected payment gateway.
CVE Details
- CVE ID:
CVE-2026-11866 - Affected component: Appointment Booking Plugin (WordPress plugin)
- Affected versions: versions before 5.6.3 (“lessThan: 5.6.3”)
- Published: July 16, 2026 at 7:16:46 AM (UTC)
- Last modified: July 16, 2026 at 4:18:59 PM (UTC)
- CVSS v3.1: Base score 5.4, MEDIUM; Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L - Authentication / privileges / user interaction: Attacker does not require privileges or authentication (PR:N) to initiate the attack; the exploit requires user interaction (UI:R) by inducing a logged-in administrator to perform an action.
- Primary impact: Confidentiality: None; Integrity: Low; Availability: Low
- CWE / weakness: CWE-352 (Cross-Site Request Forgery)
Technical Details
According to the advisory data, the plugin’s central request dispatcher handles several state-changing actions but does not validate a CSRF nonce for those actions. Because nonce validation is missing, an attacker can craft web requests that, when visited by an authenticated administrator, cause the plugin to perform privileged operations without the administrator’s explicit intent.
The description specifically notes the ability to overwrite the booking-form configuration and to disconnect the connected payment gateway. These outcomes result from state-changing endpoints or dispatcher actions being callable without a verified CSRF token. No specific function names or REST endpoints are provided in the source data.
Impact is limited to the actions explicitly described: modification of plugin configuration and disruption of payment gateway connectivity. The CVSS metrics indicate integrity and availability impacts are possible but confidentiality is not affected by this issue.
How This Could Impact Your Website
Consider a small business site running the Appointment Booking Plugin with several roles: the site owner, internal staff who manage bookings, and an external contractor who performs occasional development work. If an administrator is tricked into loading a malicious page or link, an attacker could cause the plugin to change booking-form settings or disconnect the payment gateway. Practically, this can lead to misconfigured booking workflows, interrupted payments, and disruption to customer bookings or transactions.
These changes may also increase the risk of targeted social engineering: for example, customers or staff may receive unexpected payment or booking-related messages that could be leveraged in phishing attempts. If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially administrator accounts and contributors with elevated capabilities.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and themes to reduce attack surface.
- Monitor site activity and logs for unusual administrator actions or configuration changes.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
