CVE-2026-1932: WordPress Bookr Plugin Auth Bypass Flaw

CVE-2026-1932 Overview

The Appointment Booking Calendar Plugin – Bookr plugin for WordPress contains a broken access control vulnerability due to a missing capability check on the update-appointment REST API endpoint. This authorization bypass affects all versions up to and including 1.0.2, enabling unauthenticated attackers to modify the status of any appointment through the vulnerable REST API endpoint.

Critical Impact

Unauthenticated attackers can manipulate appointment statuses across WordPress sites using the vulnerable Bookr plugin, potentially disrupting business operations and causing data integrity issues.

Affected Products

• Appointment Booking Calendar Plugin – Bookr for WordPress versions up to and including 1.0.2

Discovery Timeline

• 2026-02-14 - CVE-2026-1932 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-1932

Vulnerability Analysis

This vulnerability represents a classic case of broken access control (CWE-862: Missing Authorization) in the WordPress Bookr plugin's REST API implementation. The affected endpoint update-appointment fails to implement proper capability checks, which are essential security mechanisms in WordPress that verify whether a user has the necessary permissions to perform an action.

In WordPress, REST API endpoints should implement authorization callbacks using the permission_callback parameter to ensure only authorized users can access sensitive functionality. The vulnerable code path in appointment-controller.php at line 47 processes appointment update requests without verifying the requester's authentication status or role-based permissions.

The impact of this vulnerability centers on data integrity compromise. While confidentiality and availability are not directly affected, attackers can manipulate appointment records, potentially causing significant business disruption for organizations relying on the booking system.

Root Cause

The root cause is a missing capability check (authorization validation) in the REST API endpoint handler. WordPress REST API endpoints should validate user permissions through the permission_callback mechanism, but this critical security control was omitted from the update-appointment endpoint implementation. Without this check, the endpoint accepts and processes requests from any source, including unauthenticated users.

Attack Vector

The attack can be executed remotely over the network without requiring any authentication or user interaction. An attacker can directly send crafted HTTP requests to the WordPress REST API endpoint to modify appointment statuses. The attack requires no special privileges and has low complexity, making it accessible to unsophisticated threat actors.

The vulnerability is exploited by sending a direct REST API request to the update-appointment endpoint. The endpoint is accessible at /wp-json/bookr/v1/appointments/ and accepts POST or PUT requests with appointment modification data. Since no authentication or capability verification occurs, any appointment status can be modified by simply knowing or guessing valid appointment IDs.

Detection Methods for CVE-2026-1932

Indicators of Compromise

• Unusual REST API requests to /wp-json/bookr/v1/appointments/ from external or unauthenticated sources
• Appointment status changes without corresponding administrative user activity in WordPress logs
• High volume of PUT/POST requests to the Bookr plugin REST API endpoints
• Appointment records with modified timestamps that don't correlate with legitimate user sessions

Detection Strategies

• Monitor WordPress REST API access logs for requests to Bookr plugin endpoints from unauthenticated sessions
• Implement web application firewall (WAF) rules to flag suspicious patterns of appointment modification requests
• Review access logs for sequential appointment ID enumeration patterns indicating automated exploitation attempts

Monitoring Recommendations

• Enable detailed logging for WordPress REST API activity, particularly for the Bookr plugin endpoints
• Configure alerts for appointment status modifications occurring outside business hours or from unusual IP addresses
• Implement rate limiting on REST API endpoints to detect and block automated exploitation attempts

How to Mitigate CVE-2026-1932

Immediate Actions Required

• Update the Bookr plugin to a patched version if available from the WordPress plugin repository
• Temporarily disable the Bookr plugin if updates are not available and the functionality is not business-critical
• Implement REST API access controls at the web server or WAF level to restrict access to the vulnerable endpoint
• Review appointment records for unauthorized modifications and restore from backups if necessary

Patch Information

Organizations should check the WordPress Plugin Code Base for updates that address this vulnerability. Additional technical details are available from the Wordfence Vulnerability Analysis. The vulnerable code can be reviewed in the WordPress Plugin Code Review.

Workarounds

• Restrict access to WordPress REST API endpoints using .htaccess rules or web server configuration to block unauthenticated requests to /wp-json/bookr/
• Deploy a WAF rule to require authentication for all requests to the Bookr plugin REST API endpoints
• Consider implementing a custom WordPress plugin that adds capability checks to the vulnerable endpoint until an official patch is available

# Apache .htaccess workaround to restrict Bookr REST API access
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-json/bookr/ [NC]
RewriteCond %{HTTP:Authorization} ^$
RewriteRule .* - [F,L]
</IfModule>