CVE-2026-91847

Name of the Vulnerable Software and Affected Versions Online Scheduling and Appointment Booking System WordPress plugin versions prior to 28.2

Description The plugin fails to verify if the requester is the owner of the AI booking-assistant conversation during unauthenticated conversation actions. This allows an unauthenticated visitor to read messages from other visitors' assistant conversations and inject messages into active conversations.

Recommendations Update the Online Scheduling and Appointment Booking System WordPress plugin to version 28.2 or later.