{"id":"CVE-2026-81422","kind":"vulnerability","aliases":["CVE-2026-81422"],"related":[],"title":"WordPress appointment plugin lets anyone register accounts despite disabled registration","description":"The Advanced Appointment Booking & Scheduling WordPress plugin before 2.7 does not verify the site's user-registration setting before creating accounts through a publicly accessible shortcode, allowing unauthenticated attackers to register arbitrary user accounts, and be automatically logged in, even when user registration is disabled on the site.","summary":"The Advanced Appointment Booking & Scheduling WordPress plugin before 2.7 creates user accounts through a public shortcode without checking whether user registration is enabled on the site. An unauthenticated attacker can register an account and be logged in automatically, even when the site has registration turned off.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","self-hosted","wordpress"],"not_affected_if":["plugin-version-2.7-or-later","shortcode-not-published"],"how_to_check":"- Check the installed version of the Advanced Appointment Booking & Scheduling plugin in the WordPress admin plugins list; anything below `2.7` is affected.\n- Confirm whether 'Anyone can register' is turned off under Settings > General on the site.","fix":"- Advanced Appointment Booking & Scheduling WordPress plugin: move to `2.7` or later.","status":"open","published_at":"2026-11-09T07:17:33+00:00","first_seen_at":"2026-11-09T07:25:05+00:00","triaged_at":"2026-11-09T07:25:28+00:00","updated_at":"2026-11-09T07:25:28+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-09T07:25:28Z","model":"claude-haiku-5-5","output":{"fix":"- Advanced Appointment Booking & Scheduling WordPress plugin: move to `2.7` or later.","reach":"internet","title":"WordPress appointment plugin lets anyone register accounts despite disabled registration","impact":"medium","summary":"The Advanced Appointment Booking & Scheduling WordPress plugin before 2.7 creates user accounts through a public shortcode without checking whether user registration is enabled on the site. An unauthenticated attacker can register an account and be logged in automatically, even when the site has registration turned off.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker registers an account and gains logged-in access to the site","analyst_note":"","how_to_check":"- Check the installed version of the Advanced Appointment Booking & Scheduling plugin in the WordPress admin plugins list; anything below `2.7` is affected.\n- Confirm whether 'Anyone can register' is turned off under Settings > General on the site.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-version-2.7-or-later","shortcode-not-published"],"who_is_affected":"Sites running the Advanced Appointment Booking & Scheduling plugin before 2.7 that expose the booking shortcode publicly. The flaw lets visitors create accounts even where registration is off, so sites with registration disabled are still exposed. Sites without this plugin are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000748,"input_tokens":4556,"output_tokens":585,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-81422':13A,16A '2.7':30B,75C 'access':92C 'account':7A,33B,54B,88C,101C 'advanc':23B,68C 'allow':94C 'anyon':5A 'appoint':2A,24B,69C 'arbitrari':99C 'attack':50B,96C 'automat':59B,104C 'book':25B,70C 'check':39B 'creat':31B,87C 'cve':11A,14A 'despit':8A 'disabl':9A,112C 'enabl':44B 'even':60B,107C 'host':20B 'let':4A 'log':57B,105C 'plugin':3A,28B,73C 'public':36B,91C 'regist':6A,52B,98C 'registr':10A,42B,65B,84C,110C 'schedul':26B,71C 'self':19B 'self-host':18B 'set':85C 'shortcod':37B,93C 'site':47B,63B,80C,115C 'turn':66B 'unauthent':49B,95C 'user':32B,41B,83C,100C,109C 'user-registr':82C 'verifi':78C 'whether':40B 'without':38B 'wordpress':1A,21B,27B,72C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Advanced Appointment Booking & Scheduling plugin before 2.7 that expose the booking shortcode publicly. The flaw lets visitors create accounts even where registration is off, so sites with registration disabled are still exposed. Sites without this plugin are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","other","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-2026':12A,15A '-81422':13A,16A 'account':7A 'anyon':5A 'appoint':2A 'cve':11A,14A 'despit':8A 'disabl':9A 'let':4A 'plugin':3A 'regist':6A 'registr':10A 'wordpress':1A","search_b":"'2.7':30B 'account':33B,54B 'advanc':23B 'appoint':24B 'attack':50B 'automat':59B 'book':25B 'check':39B 'creat':31B 'enabl':44B 'even':60B 'host':20B 'log':57B 'plugin':28B 'public':36B 'regist':52B 'registr':42B,65B 'schedul':26B 'self':19B 'self-host':18B 'shortcod':37B 'site':47B,63B 'turn':66B 'unauthent':49B 'user':32B,41B 'whether':40B 'without':38B 'wordpress':21B,27B","search_c":"'2.7':75C 'access':92C 'account':88C,101C 'advanc':68C 'allow':94C 'appoint':69C 'arbitrari':99C 'attack':96C 'automat':104C 'book':70C 'creat':87C 'disabl':112C 'even':107C 'log':105C 'plugin':73C 'public':91C 'regist':98C 'registr':84C,110C 'schedul':71C 'set':85C 'shortcod':93C 'site':80C,115C 'unauthent':95C 'user':83C,100C,109C 'user-registr':82C 'verifi':78C 'wordpress':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T07:17:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-81422","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81422","severity":null,"published_at":"2026-11-09T07:17:33+00:00","modified_at":"2026-11-09T07:17:33+00:00","first_seen_at":"2026-11-09T07:25:05+00:00","fetched_at":"2026-11-09T07:25:05+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}