CVE-2025-46247: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in codepeople's Appointment Booking Calendar WordPress plugin affecting versions through 1.3.92. The vulnerability was disclosed on April 22, 2025, and allows unauthorized access to functionality not properly constrained by Access Control Lists (ACLs) (NVD, Patchstack).

The vulnerability is classified as a Broken Access Control issue with a CVSS v3.1 base score of 5.3 (Medium) according to Patchstack, though NVD rates it at 9.8 (Critical) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue stems from missing authorization checks that could allow unprivileged users to execute higher privileged actions (Patchstack).

The vulnerability could potentially allow unauthorized users to access functionality that should be restricted by access control lists. While Patchstack considers this a low severity issue unlikely to be exploited, NVD's assessment suggests potential for complete compromise of confidentiality, integrity, and availability of the affected system (NVD).

Users are advised to update to version 1.3.93 or later of the Appointment Booking Calendar plugin to address this vulnerability (Patchstack).