CVE-2026-66679— WordPress Appointment Hour Booking plugin <= 1.5.91 - Broken Access Control vulnerability
Quick assessment
Affected
codepeople Appointment Hour Booking
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress Appointment Hour Booking是WordPress基金会的一款预约小时预订的插件。 WordPress Appointment Hour Booking 1.5.91及之前版本存在输入验证错误漏洞，该漏洞源于访问控制不当，可能导致未经身份验证的攻击者进行未授权操作。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| codepeople | Appointment Hour Booking | n/a≤ 1.5.91 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-66679
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress Appointment Hour Booking plugin <= 1.5.91 - Broken Access Control vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Unauthenticated Broken Access Control in Appointment Hour Booking <= 1.5.91 versions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1284
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress Appointment Hour Booking 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress Appointment Hour Booking是WordPress基金会的一款预约小时预订的插件。 WordPress Appointment Hour Booking 1.5.91及之前版本存在输入验证错误漏洞，该漏洞源于访问控制不当，可能导致未经身份验证的攻击者进行未授权操作。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| codepeople | Appointment Hour Booking | n/a ~ 1.5.91 | - |
|
II. Public POCs for CVE-2026-66679
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-66679
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-66679 (1)
IV. Related Vulnerabilities
Same product: Appointment Hour Booking
-
CVE-2026-86475
Appointment Hour Booking < 1.5.95 - Unauthenticated Booking -
CVE-2026-16282
Appointment Hour Booking < 1.5.88 - Unauthenticated Booking -
CVE-2026-65514
WordPress Appointment Hour Booking plugin <= 1.5.86 - Cross -
CVE-2023-45649
WordPress Appointment Hour Booking plugin <= 1.4.23 - Broken -
CVE-2024-32720
WordPress Appointment Hour Booking plugin <= 1.4.56 - Captch
Same vendor: codepeople
-
CVE-2026-110701
CP Multi View Events Calendar <= 1.4.42 - Unauthenticated St -
CVE-2026-109901
WordPress CP Multi View Event Calendar plugin <= 1.4.41 - S -
CVE-2026-95598
WordPress Search in Place plugin <= 1.5.5 - Cross Site Scrip -
CVE-2026-103909
Calculated Fields Form <= 5.5.1.5 - Reflected DOM-Based Cros -
CVE-2026-100184
Calculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cros
Same weakness: CWE-1284
-
CVE-2026-103350
WordPress Booking and Rental Manager plugin <= 2.8.0 - Other -
CVE-2026-102184
Junos OS and Junos OS Evolved: A malformed EVPN SRv6 route c -
CVE-2026-102183
Junos OS and Junos OS Evolved: If in a BGP EVPN scenario a m -
CVE-2026-102033
Junos OS and Junos OS Evolved: An attacker causes denial of -
CVE-2026-102019
Junos OS and Junos OS Evolved: Malformed RIPv2 messages caus
V. Comments for CVE-2026-66679
No comments yet