CVE-2026-86839
Low
Description
The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff member, allowing authenticated attackers with a staff-level account to view, modify and delete other staff members' appointments and payments, including the associated customer's personal information.
SeverityLow
CVSS3.8
Exploit probability—
ProductOnline Scheduling and Appointment Booking System
PublishedSep 27, 2026
First seenSep 27, 2026
How to fix
Update
- Online Scheduling and Appointment Booking System28.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Online Scheduling and Appointment Booking System | v < 28.3 | 28.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.