Unauthenticated user registration in Advanced Appointment Booking
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from CNA.
Summary
The Advanced Appointment Booking & Scheduling WordPress plugin before 2.7 does not check the site's user-registration setting before creating accounts through a publicly accessible shortcode. An unauthenticated attacker can register arbitrary user accounts and be logged in automatically, even when user registration is disabled on the site. A public exploit is linked in the references.
Written with Claude Haiku 5.5 from the sources below · 2026-11-09
Description from the CNA
The Advanced Appointment Booking & Scheduling WordPress plugin before 2.7 does not verify the site's user-registration setting before creating accounts through a publicly accessible shortcode, allowing unauthenticated attackers to register arbitrary user accounts, and be automatically logged in, even when user registration is disabled on the site.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Advanced Appointment Booking & Scheduling | before 2.7 | 2.7 | Patch available | CNA |
- Advanced Appointment Booking & Scheduling VendorUnknown Affected before 2.7 Fixed in 2.7 Patch available CNA
Remediation
Update Advanced Appointment Booking & Scheduling to version 2.7.
Written with Claude Haiku 5.5 from the sources below · 2026-11-09
- Fix · CNA Advanced Appointment Booking & Scheduling (Unknown) Fixed in 2.7
Timeline
- 2026-11-09 Threatist record created from CVE-2026-81422
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences