CVE-2026-9830: BookingPress Auth Bypass Vulnerability

CVE-2026-9830 Overview

CVE-2026-9830 affects the BookingPress Appointment Booking Pro WordPress plugin in versions before 5.7.3. The plugin fails to correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication. Unauthenticated attackers can read customer booking data and modify other users' bookings across affected sites. The vulnerability maps to [CWE-287] Improper Authentication and carries a CVSS score of 8.2. Exploitation requires only network access to the WordPress REST API, with no user interaction or privileges.

Critical Impact
Unauthenticated attackers can access customer booking data and tamper with other users' bookings through exposed REST API endpoints.

Affected Products

BookingPress Appointment Booking Pro WordPress plugin versions prior to 5.7.3

Discovery Timeline

2026-07-27 - CVE-2026-9830 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-9830

Vulnerability Analysis

The flaw resides in how the plugin registers REST API routes with WordPress. When registering routes via register_rest_route(), developers supply a permission_callback that WordPress invokes before dispatching the request handler. The BookingPress Appointment Booking Pro plugin registers its permission callback incorrectly, causing WordPress to treat the routes as publicly accessible.

As a result, every endpoint in the affected API namespace becomes reachable without authentication. Attackers can enumerate bookings, retrieve customer records, and issue write operations that mutate reservations belonging to other users. The consequences include exposure of personally identifiable information (PII) tied to bookings and integrity loss across scheduling data.

Root Cause

The root cause is an improper implementation of the REST permission callback. When a callback is missing or returns a permissive value by default, WordPress will not enforce authentication or capability checks on the route. This aligns with [CWE-287] Improper Authentication, where the authentication mechanism exists but does not function as intended.

Attack Vector

Exploitation occurs over the network against the WordPress REST API. An attacker sends unauthenticated HTTP requests to the vulnerable plugin's REST namespace and receives responses that should require valid session credentials or administrative capabilities. No user interaction is required, and attack complexity is low. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-9830

Indicators of Compromise

Unauthenticated HTTP GET or POST requests to /wp-json/ paths belonging to the BookingPress plugin namespace
Unexpected modifications to booking records without corresponding authenticated administrator sessions
Access log entries showing anonymous clients enumerating booking IDs or customer identifiers

Detection Strategies

Audit WordPress access logs for requests targeting BookingPress REST routes originating from clients without valid authentication cookies or nonces
Compare booking database change timestamps against authenticated administrator activity to identify anomalous writes
Deploy web application firewall rules that flag anonymous access to booking-related REST namespaces

Monitoring Recommendations

Enable verbose logging for the WordPress REST API and forward events to a centralized log platform for correlation
Alert on spikes in /wp-json/ traffic volumes and on requests returning HTTP 200 responses containing customer PII fields
Track plugin version inventory across managed WordPress sites to identify hosts still running versions prior to 5.7.3

How to Mitigate CVE-2026-9830

Immediate Actions Required

Update the BookingPress Appointment Booking Pro plugin to version 5.7.3 or later on all affected WordPress sites
Review booking records and audit logs for unauthorized reads or modifications since the vulnerable version was installed
Rotate any API keys or credentials that may have been exposed through booking metadata

Patch Information

The vendor addressed CVE-2026-9830 in BookingPress Appointment Booking Pro version 5.7.3. The fix corrects registration of the REST permission callback so that authentication and capability checks execute before route handlers run. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Restrict access to the WordPress REST API at the web server or WAF layer until the plugin can be updated
Temporarily deactivate the BookingPress Appointment Booking Pro plugin on sites that cannot be patched immediately
Limit outbound exposure of the affected REST namespace using IP allowlists for administrative networks

bash

# Example WAF rule to block unauthenticated access to BookingPress REST routes
# Adjust namespace path to match your installation
location ~ ^/wp-json/bookingpress/ {
    if ($http_cookie !~ "wordpress_logged_in") {
        return 403;
    }
}