CVE-2026-1932: 
WordPress vulnerability analysis and mitigation

CVE-2026-1932 is a Missing Authorization vulnerability in the Appointment Booking Calendar Plugin – Bookr for WordPress. Due to a missing capability check on the update-appointment REST API endpoint, unauthenticated attackers can modify the status of any appointment on affected sites. All versions up to and including 1.0.2 are affected. The vulnerability was published on February 14, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (Red Hat CVE).

The root cause is classified as CWE-862 (Missing Authorization) — the plugin's REST API endpoint for updating appointment status does not verify whether the requesting user has the necessary permissions before processing the request. Because the endpoint is accessible without authentication, any remote actor can send a crafted REST API request to alter appointment records. No special privileges, user interaction, or complex conditions are required for exploitation (Red Hat CVE).

Successful exploitation allows unauthenticated attackers to arbitrarily modify the status of any appointment managed by the plugin (e.g., canceling, confirming, or otherwise altering bookings). The impact is limited to integrity — there is no direct confidentiality or availability impact — but manipulation of appointment data could disrupt business operations, cause scheduling conflicts, or enable denial-of-service against booking workflows for affected WordPress sites (Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.015%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The low attack complexity and lack of authentication requirements do, however, lower the barrier for opportunistic exploitation (Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the Bookr Appointment Booking Calendar Plugin (version ≤ 1.0.2) using tools like WPScan, Shodan, or by inspecting plugin directories exposed via the target site.
2. Enumerate appointments: Query the plugin's REST API (e.g., GET /wp-json/<bookr-namespace>/appointments) to discover valid appointment IDs, if the endpoint exposes them without authentication.
3. Craft malicious request: Construct an unauthenticated HTTP request targeting the update-appointment REST API endpoint, including a target appointment ID and the desired status value (e.g., cancelled, confirmed).
4. Submit request: Send the crafted request (e.g., POST /wp-json/<bookr-namespace>/update-appointment with appropriate JSON body) without any authentication headers.
5. Verify impact: Confirm the appointment status has been modified by querying the appointment record, achieving unauthorized data manipulation (Red Hat CVE).

• Network: Unexpected or repeated unauthenticated REST API requests to WordPress endpoints matching the Bookr plugin's update-appointment route (e.g., /wp-json/*/update-appointment) from external IP addresses.
• Logs: WordPress access logs showing POST requests to the Bookr REST API endpoint without authentication cookies or tokens, particularly with varying appointment IDs in rapid succession.
• Application: Unexplained changes to appointment statuses (e.g., mass cancellations or confirmations) not correlated with legitimate user activity in the Bookr plugin's admin dashboard.

Users should update the Bookr Appointment Booking Calendar Plugin to a version beyond 1.0.2 that includes a proper capability check on the update-appointment REST API endpoint. If an updated version is not yet available, site administrators should consider temporarily disabling the plugin or restricting REST API access via a web application firewall (WAF) rule blocking unauthenticated requests to the affected endpoint. Monitor the WordPress plugin repository for a patched release (Red Hat CVE).