A missing authorization flaw in the Wappointment WordPress plugin permits attackers to bypass intended restriction safeguards and gain unauthorized access to sensitive plugin features. The vulnerability stems from incorrectly configured access control security levels, which effectively removes checks that should limit who can view or modify appointment data and configuration settings. Because the flaw is a direct omission of authentication enforcement, attackers could potentially read, modify, or delete appointment information, expose client data, or alter system settings, posing confidentiality and integrity risks to any site using the affected plugin.

The issue affects the Wappointment plugin developed by the Wappointment team for WordPress, impacting all installations with versions 2.7.6 and earlier. Users running the plugin in those versions are at risk unless they upgrade or apply another fix.

The vulnerability has a CVSS score of 5.3, indicating moderate severity, and an EPSS score of less than 1 %, implying a low probability of exploitation in the wild. It is not listed in CISA’s KEV catalog. The description does not explicitly state the attack vector. Based on the description, it is inferred that the vulnerability could be exploited via web interactions with the plugin’s administrative or front‑end interfaces. An attacker likely requires some level of prior access to the site, such as an authenticated user account, to interact with the plugin’s restricted endpoints.