CVE-2026-105197

Name of the Vulnerable Software and Affected Versions Appointment Booking Plugin WordPress plugin versions prior to 5.6.5

Description An authentication bypass occurs because the plugin fails to verify if a backend staff user is authorized to perform actions on a specific record targeted for deletion. This allows an authenticated user with a record-scoped staff role to irreversibly delete any order, customer, or transaction on the site, including records belonging to other staff members or those outside their assigned scope.

Recommendations Update the Appointment Booking Plugin to version 5.6.5 or later.