CVE-2025-13317: 
WordPress 脆弱性の分析と軽減

The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.3.96. The vulnerability was discovered and disclosed on November 22, 2025. This security issue affects the plugin's booking processing endpoint (cpabcappointmentscheckIPNverification) which fails to properly verify payment notifications (NVD).

The vulnerability stems from the plugin exposing an unauthenticated booking processing endpoint that accepts payment notifications without proper origin verification or authorization checks. The affected endpoint 'cpabcappointmentscheckIPNverification' trusts attacker-supplied payment notifications via the 'cpabc_ipncheck' parameter without validation. The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (Wordfence).

The vulnerability allows unauthenticated attackers to arbitrarily confirm bookings and insert them into the live calendar. This can trigger administrative and customer notification emails and disrupt business operations by creating unauthorized appointments (NVD).

Users should update to version 1.3.97 or later which includes a more complete PayPal IPN verification system to address this vulnerability (Security Online).