WordPress Plugin Vulnerabilities

Appointment Bookings for Zoom GoogleMeet and more – Wappointment <= 2.7.7 - Unauthenticated Insecure Direct Object Reference

Description

The Appointment Bookings for Zoom GoogleMeet and more – Wappointment plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.7. This is due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
wappointment
No known fix

References

CVE
CVE-2026-39756
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/903f706c-4078-4c99-92e0-0f8ab27848f1

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Md. Minaruzzaman Shovon
Verified
No
WPVDB ID
ab32148d-eae8-41ec-8dff-cc9c0f233888

Timeline

Publicly Published
2026-10-05 (about 24 days ago)
Added
2026-10-09 (about 21 days ago)
Last Updated
2026-10-09 (about 21 days ago)

Other

Published
Title
Published
2025-05-08
Title
WPBookit < 1.0.3 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Email Update
Published
2026-09-29
Title
Payments for Hubtel < 1.0.2 - Unauthenticated Order Key Disclosure via IDOR
Published
2024-01-10
Title
Contact Form 7 – Dynamic Text Extension < 4.2.0 - Insecure Direct Object Reference
Published
2021-10-11
Title
Squaretype Modern Blog < 3.0.4 - Unauthenticated Private/Schedule Posts Disclosure
Published
2026-09-14
Title
KBoard < 6.7 - Unauthenticated Board Media Deletion via IDOR