Live › vulnerability › CVE-2026-105257
Go to dashboardThe Appointment Booking Plugin for WordPress, before version 5.7.5, does not check whether an authenticated agent is assigned to a customer before returning that customer's record. Any logged-in agent can read and enumerate personal data for all customers on the site, including those managed by other agents.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Appointment Booking Plugin for WordPress before 5.7.5 that have agent-level users. The exposure comes from authenticated agents seeing customers assigned to other agents, so sites with only administrators or no agent role are less exposed. Sites on 5.7.5 or later are not affected.
No product ranges from the sources yet.
5.7.5.5.7.5 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is assigned to a customer before returning or searching that customer's record, allowing any agent to read and enumerate the personal information of every customer on the site, including those managed by other agents.
This page as .md · .json · in your agent: get_signal("CVE-2026-105257")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.