The Wappointment plugin for WordPress, version 2.7.7 and earlier, contains an unauthenticated insecure direct object reference that allows actors without any authentication to target specific appointment resources by ID. By supplying crafted requests to these endpoints, an attacker can read, update, or delete appointment details, exposing sensitive client information and potentially disrupting scheduled services. The flaw is identified as CWE-639 and represents a direct breach of data integrity and confidentiality.

WordPress installations that have the Wappointment plugin 2.7.7 or lower are affected. The issue is confined to this plugin; the core WordPress code and other plugins remain unaffected unless they expose similar endpoints.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of less than 1% suggests a low current exploitation probability, but the lack of any authentication requirement means exploitation is relatively straightforward for an attacker with simple HTTP access. As the vulnerability is not listed in the CISA KEV catalog, no publicly documented exploit exists yet, yet the risk remains for sites that expose appointment management URLs to the public internet.