The Wappointment WordPress plugin is vulnerable to an Insecure Direct Object Reference weakness (CWE‑639). The plugin generates an appointment edit key by hashing together a client identifier, the appointment start time, and a staff identifier using MD5 without a secret salt. Because each value is publicly visible or sequential, an attacker can reconstruct a valid key for any booking. Once a key is known, the unauthenticated REST endpoints that cancel or reschedule appointments can be called, causing arbitrary manipulation of other users’ bookings. This flaw allows an attacker to cancel or reschedule any appointment belonging to anyone on the site without requiring authentication.

The vulnerability applies to every WordPress installation that uses any version of Wappointment up through 2.7.6 and has the allow_cancellation or allow_rescheduling settings enabled. These configuration options are commonly turned on for active booking deployments, extending the potential impact to a wide range of sites that have not applied a patch or changed the configuration.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of less than 1 % suggests that active exploitation of this flaw is currently uncommon. The vulnerability is not listed in the CISA KEV catalog. The attacker does not need to be authenticated; by simply booking an appointment they can learn the sequential client_id, observe the publicly visible start time, and correlate a staff identifier. With these three pieces they can compute the edit key and invoke the REST endpoints. The absence of any ownership or identity checks makes the flaw highly exploitable for any site running the vulnerable configuration.