The vulnerability allows unauthenticated attackers to generate a valid authentication token by exploiting a hardcoded fallback salt used in the hash() function of the plugin. Once the token is known, the attacker can view confidential booking details and modify booking information, thereby breaching both confidentiality and integrity of the booking system.

WordPress sites that use the Appointment Booking Calendar – Simply Schedule Appointments Booking Plugin up to and including version 1.6.9.5, which do not override the default hardcoded salt in wp-config.php.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog, but the attack vector is unauthenticated, meaning an external attacker can exploit it immediately without needing login credentials. Consequently, the risk is moderate but exploitability is limited by the low EPSS score.