The vulnerability in the Appointment Booking Calendar plugin allows an attacker to use the unprotected cpabc_appointments_check_IPN_verification endpoint, trusting the cpabc_ipncheck parameter sent in payment notifications. Because no authorization is performed, a malicious actor can craft a request that marks a booking as confirmed, causing it to appear in the live calendar and trigger administrative and customer notification emails. The attacker effectively gains the ability to create or alter appointments without any credentials, leading to unauthorized bookings and disruptions of booking workflows.

Affected products include the codepeople Appointment Booking Calendar plugin for WordPress, specifically every release up to and including version 1.3.96. No other products or vendor versions are listed as affected. The issue originates from the plugin’s payment notification handling code.

The CVSS score of 5.3 indicates moderate impact. The EPSS score is less than 1%, suggesting a very low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the attack vector is unauthenticated HTTP requests to the exposed endpoint, which an attacker can send from anywhere on the Internet. The primary requirement for exploitation is the ability to create a POST request containing a cpabc_ipncheck value; no additional authentication or privileged access is needed.