The Wappointment WordPress plugin creates a key used for cancellation and time, and the staff identifier with MD5, without any salt or random component. This predictable key allows an attacker to reconstruct valid keys for any appointment if they can determine the three inputs. The REST endpoints that perform these actions validate only the key and perform no ownership or authentication checks, enabling.

WordPress sites that install Wappointment plugin version 2.7.6 or earlier and have the allow_cancellation or commonly activated on active booking deployments, meaning many sites that have not yet upgraded are at risk.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of 0.00297 (roughly 0.3%). The plugin is not listed in the CISA KEV catalog. An unauthenticated attacker can first book an appointment to learn the sequential client identifier and then, using publicly visible appointment times and staff identifiers, compute a valid edit key to cancel or reschedule any other appointment. This attack path requires no additional credentials and relies solely on the predictable key generation.