The Appointment Booking Plugin does not verify that a staff user is authorized to act on the specific record targeted for deletion, enabling any staff member with a record‑scoped role to irreversibly delete any order, customer, or transaction on the WordPress site, including records belonging to other staff and outside their assigned scope. This lack of authorization checks constitutes an Insecure Direct Object Reference (CWE‑639) and results in irreversible data loss.

The issue affects all installations of the Appointment Booking Plugin older than version 5.6.5 on WordPress sites. The plugin does not check that a staff user has permission to delete the specific record, therefore any staff user with a record‑scoped role can delete orders, customers, or transactions that belong to other staff or that lie outside their authorized scope.

The CVSS score is 2.7, indicating a moderate impact, and the EPSS score is less than 1%, suggesting a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated staff user with a record‑scoped role and knowledge of the target record’s identifier. Once the delete request reaches the plugin’s backend endpoint, the record is permanently removed.