CVE-2026-66679: Appointment Hour Booking Auth Bypass Flaw

CVE-2026-66679 Overview

CVE-2026-66679 is an unauthenticated broken access control vulnerability affecting the Appointment Hour Booking WordPress plugin in versions 1.5.91 and earlier. The flaw allows remote attackers to interact with plugin functionality without providing valid credentials. Successful exploitation can lead to limited integrity and availability impact on affected WordPress sites. The weakness is categorized under CWE-1284: Improper Validation of Specified Quantity in Input. Patchstack published the vulnerability analysis, and no public exploit code has been observed to date.

Critical Impact
Remote unauthenticated attackers can bypass access controls in the Appointment Hour Booking plugin to modify booking data or disrupt availability on WordPress sites running vulnerable versions.

Affected Products

Appointment Hour Booking WordPress plugin versions <= 1.5.91
WordPress sites with the plugin installed and network-accessible
Shared and multi-tenant WordPress hosting environments running the affected plugin

Discovery Timeline

2026-08-18 - CVE-2026-66679 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-66679

Vulnerability Analysis

The Appointment Hour Booking plugin exposes functionality that lacks proper authorization checks. Requests reach plugin endpoints without the plugin validating the requester's capability or authentication state. An unauthenticated attacker can invoke these endpoints over the network to trigger actions reserved for authorized users. The impact is bounded to limited integrity and availability effects, without direct disclosure of confidential data. The Exploit Prediction Scoring System (EPSS) currently places this issue in the lower band of near-term exploitation likelihood, but WordPress plugin flaws frequently attract opportunistic scanning once disclosed.

Root Cause

The root cause is missing or improper access control enforcement on plugin request handlers. The plugin does not consistently verify that a caller holds the required WordPress capability or nonce before executing sensitive operations. This aligns with CWE-1284, where input specifying an action or quantity is not validated against expected constraints.

Attack Vector

Exploitation occurs over the network with low attack complexity and no privileges required. An attacker sends crafted HTTP requests to the vulnerable plugin endpoints exposed by a target WordPress site. No user interaction is needed. See the Patchstack Vulnerability Analysis for the technical write-up. No verified proof-of-concept code is available at this time, so the exploitation mechanism is described in prose rather than reproduced here.

Detection Methods for CVE-2026-66679

Indicators of Compromise

Unexpected booking records, modifications, or deletions in the Appointment Hour Booking plugin database tables.
Anomalous HTTP POST or GET traffic to admin-ajax.php or plugin-specific endpoints from unauthenticated sessions.
WordPress activity or audit logs showing plugin actions without a corresponding authenticated user session.

Detection Strategies

Inventory WordPress installations and flag any site running Appointment Hour Booking version 1.5.91 or earlier.
Inspect web server access logs for repeated requests to plugin action handlers from single source IPs.
Correlate WordPress option and post metadata changes with the absence of authenticated administrator activity.

Monitoring Recommendations

Enable verbose logging on WordPress and forward logs to a central SIEM for correlation.
Alert on spikes in admin-ajax.php requests referencing Appointment Hour Booking action parameters.
Monitor for new or modified booking entries created outside expected business hours.

How to Mitigate CVE-2026-66679

Immediate Actions Required

Update the Appointment Hour Booking plugin to a version later than 1.5.91 as soon as the vendor publishes a fixed release.
Restrict access to WordPress administrative and AJAX endpoints using a web application firewall (WAF) rule set.
Review booking data for unauthorized changes and remove any suspicious entries.

Patch Information

Refer to the Patchstack Vulnerability Analysis for the authoritative patch status. Apply the vendor-supplied update to a version above 1.5.91 when available. Until a fixed release is confirmed, treat the plugin as vulnerable in all deployments.

Workarounds

Deactivate and remove the Appointment Hour Booking plugin on sites that do not require booking functionality.
Deploy WAF rules to block unauthenticated requests to plugin action endpoints.
Enforce IP allowlisting on the /wp-admin/ path to limit exposure of plugin handlers reachable via admin-ajax.php.

bash

# Configuration example: block unauthenticated access to the plugin's AJAX actions via NGINX
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "appointment-hour-booking") {
        # Require an authenticated WordPress session cookie
        if ($http_cookie !~* "wordpress_logged_in_") {
            return 403;
        }
    }
    include fastcgi_params;
    fastcgi_pass php-fpm;
}