CVE Catalog
CVE-2026-66679
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk0.34%
27th percentile - higher than 27% of all known CVEs
Summary
Broken Access Control vulnerability in Appointment Hour Booking versions up to 1.5.91. The attack does not require authentication.
Risk Assessment
An unauthenticated attacker can gain unauthorized access to functions, potentially leading to modification of bookings, data theft, or other damage.
Recommendation
Update the Appointment Hour Booking plugin to the latest version that includes the fix.
Original NVD description (English source)
Unauthenticated Broken Access Control in Appointment Hour Booking <= 1.5.91 versions.