The Appointment Booking Plugin for WordPress fails to restrict which booking fields can be set through its public booking funnel. An unauthenticated user can assign privileged fields, such as approval status, to a booking object. This flaw allows the attacker to create or modify bookings that appear approved without the normal administrative review. The weakness is a mass‑assignment vulnerability, classified as CWE‑284, enabling unauthorized privilege escalation within the booking workflow.

WordPress sites that use the Appointment Booking Plugin in a version prior to 5.6.8 are affected. The plugin provides a public booking interface that accepts user input without validating or limiting the fields that can be set, allowing manipulation of privileged properties.

The CVSS score of 5.3 indicates moderate severity, while an EPSS score of less than 1% shows that the expected exploitation prevalence is very low. The vulnerability is not listed in the CISA KEV catalogue. The likely attack vector is through the publicly accessible booking page, which can be accessed over the web by anyone without authentication. Exploitation requires only sending a crafted booking request that includes a privileged field; if successful, the attacker can generate approved bookings, potentially overbooking resources or creating fraudulent appointments.