Junglewise Threat Intelligence

CVE-2026-9188: Wappointment WordPress Plugin IDOR in Appointment Cancellation

CVE-2026-9188 · Severity: medium · CVSS 5.3 · Published 2026-07-02

Executive brief

The Wappointment plugin for WordPress, which manages online scheduling for services like Zoom and Google Meet, contains a security flaw that allows unauthorized individuals to cancel or reschedule appointments. By predicting a simple security key, an attacker can interfere with bookings belonging to other customers without needing to log in. This could lead to significant operational disruption and loss of business for organizations relying on the plugin for their scheduling needs.

Technical details

The Wappointment plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) via the 'appointmentkey' parameter in versions up to and including 2.7.6. The vulnerability stems from the 'edit_key' being generated as a predictable, unsalted MD5 hash of the 'client_id' (sequential integer), 'start_at' (public timestamp), and 'staff_id' (enumerable integer). Because the unauthenticated cancellation and rescheduling REST endpoints perform no additional identity verification, an attacker can reconstruct these keys to manipulate appointments belonging to other users. Exploitation is possible if the 'allow_cancellation' or 'allow_rescheduling' settings are enabled. A fix is available in newer versions of the plugin.

Affected products

  • Wappointment Appointment Bookings for Zoom GoogleMeet and more – Wappointment up to and including 2.7.6

Timeline

  • 2026-07-02: disclosed: Published on NVD and Wordfence

References