CVE-2026-9188

Name of the Vulnerable Software and Affected Versions Wappointment versions prior to 2.7.7

Description The plugin contains an Insecure Direct Object Reference (IDOR) flaw involving the appointmentkey parameter. The issue stems from the edit key used by the tryCancel() function being generated as a predictable, unsalted MD5 hash of the client id (a sequential integer), start at (a public timestamp), and staff id (an enumerable integer). Because the unauthenticated cancellation and rescheduling REST endpoints do not verify ownership beyond this reconstructible key, attackers can compute valid keys for other users to cancel or reschedule appointments. This exploitation is possible when the allow cancellation or allow rescheduling settings are enabled.

Recommendations Update to a version newer than 2.7.6. As a temporary mitigation, disable the allow cancellation and allow rescheduling settings.