The Appointment Booking Plugin for WordPress does not verify that an authenticated agent user is actually assigned to a specific customer before exposing that customer's data. As a result, any agent can read and enumerate personal information for all customers on the site, leading to a breach of confidentiality.

WordPress sites that install the Appointment Booking Plugin and use any version earlier than 5.7.5. The vulnerability exists regardless of the number of agents or customers, as the plugin does not enforce ownership checks on customer data.

Based on the description, this is an Insecure Direct Object Reference. Authenticated agent‑level users can disclose sensitive personal information of other agents' customers. Because the vulnerability is purely software‑controlled and does not require additional privileges or user interaction beyond valid login credentials, the exploitation risk is low, as indicated by a CVSS score of 2.7. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, but the impact on confidentiality is significant.