The Smart Appointment & Booking plugin for WordPress contains a missing capability check combined with a nonce validation bug in the cancel booking function. The code tests the nonce with an AND operator instead of OR, which effectively bypasses security when any nonce value is supplied. This flaw lets an unauthenticated attacker supply a predictable booking identifier and delete or alter that appointment, compromising data integrity and causing denial of service to legitimate users.

All installations of the Smart Appointment & Booking plugin, version 1.0.8 or earlier, running on a WordPress site are vulnerable. The issue is confined to the cancel booking endpoint exposed by the plugin.

The vulnerability carries a CVSS score of 5.3, indicating a medium impact. The EPSS score is not provided, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit it directly via a crafted HTTP request to the plugin’s cancel action without authentication; the prerequisite is simply knowing a valid booking ID, which can be guessed or discovered through other means. The lack of access control makes this flaw easily exploitable in any unauthenticated environment.