An authentication bypass occurs because the `AddBookingCommand` function in `Command.php` skips nonce verification, allowing unauthenticated users to submit booking data. Although the `firstName` and `lastName` variables are processed by `sanitize text field()`, this function preserves double quotes. In the administrative Calendar view, the `eventContent` callback in `redesign/dist/index.js` interpolates these names into JavaScript template literals and renders them via `innerHTML` without proper HTML entity encoding. This allows an unauthenticated attacker to inject arbitrary web scripts through the customer name fields that execute when an administrator hovers over the malicious appointment on the Calendar page.