Advanced Appointment Booking & Scheduling < 2.7 - Unauthenticated Arbitrary User Registration

Description

The plugin does not verify the site's user-registration setting before creating accounts through a publicly accessible shortcode, allowing unauthenticated attackers to register arbitrary user accounts, and be automatically logged in, even when user registration is disabled on the site.