The Bookr Appointment Booking Calendar Plugin for WordPress contains a missing capability check on the update-appointment REST API endpoint, allowing any unauthenticated user to modify the status of any appointment. This flaw compromises the integrity of appointment data, enabling attackers to arbitrarily confirm, cancel, or otherwise change appointments without authorization. The vulnerability is formally categorized as CWE‑862.

All WordPress installations running Bookr version 1.0.2 or earlier are affected. The plugin provides the REST endpoint through WordPress’s API and is typically installed on websites that use the plugin to manage client appointments.

The CVSS v3 score is 5.3, indicating moderate severity. EPSS is listed as less than 1 %, reflecting a low current exploitation probability, and the vulnerability is not yet included in CISA’s KEV catalog. Nevertheless, the flaw is exploitable over an application‑level REST API, requiring only a crafted HTTP request to the /wp-json/bookr/v1/update-appointment endpoint. Because no authentication is performed, any internet‑reachable WordPress site with the vulnerable plugin could be targeted directly, making the risk significant for exposed or poorly monitored services.