Vulnerability record/PUBLISHED/Published Nov 9, 2026 06:00:29 UTC
CVE-2026-81422
The Advanced Appointment Booking & Scheduling WordPress plugin before 2.7 does not verify the site's user-registration setting before creating accounts through a publicly accessible shortcode, allowing unauthenticated attackers to register arbitrary user accounts, and be automatically logged in, even when user registration is disabled on the site.
Base scoreN/A/ 10
SeverityNoneCVSS unscored
Exploitability / impact
CVSS metric breakdown
Base severityNone
No CVSS vector is available for this record.
CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityWPScan
Last updatedNov 9, 2026 06:00:29 UTC
PublishedNov 9, 2026 06:00:29 UTC
ReservedAug 26, 2026 19:05:48 UTC
Credits
- Daniel Dhaniswara
- WPScan