CVE-2026-105196
Low · CVSS 3.3 (NVD) · fetched 2026-10-24
The Appointment Booking Plugin WordPress plugin before 5.6.9 does not enforce per-record authorization on several of its AI Abilities API actions, allowing an authenticated user holding the LatePoint Agent role, normally restricted to their own records, to read and modify other agents' profile data and read other agents' bookings and associated customer details when the Abilities API feature is enabled.
Remediation
Apply the updates and mitigations in the source advisory; if no fix is available, follow the advisory's guidance on restricting or discontinuing use.
Affected PHP branches
See the source advisory.
Source: NIST National Vulnerability Database (NVD) · retrieved 2026-10-24T13:48:10-04:00 · https://nvd.nist.gov/vuln/detail/CVE-2026-105196