The vulnerability arises from a missing or incorrectly applied REST permission callback in the BookingPress Appointment Booking Pro plugin before version 5.7.3. This oversight allows any party to invoke the plugin’s API endpoints without authentication, exposing personal identifying information of customers and enabling unauthorized modification of existing bookings. The flaw is categorized as CWE‑287, indicating an authentication bypass.

WordPress sites running the BookingPress Appointment Booking Pro plugin earlier than version 5.7.3 are vulnerable. Any installation of the plugin older than 5.7.3 exposes its REST API routes to unauthenticated access.

The issue has a CVSS score of 8.2, classifying it as high severity, and an EPSS score of 0.00248 (<1%), indicating a low probability of exploitation. However, the absence of authentication checks makes exploitation straightforward: a remote actor can send crafted HTTP requests to the plugin’s REST routes from any network location. The vulnerability is not listed in the CISA KEV catalog, implying that public exploits are not yet documented but the risk to confidentiality and integrity remains significant.