---
id: "CVE-2026-81422"
page: "https://infrastack.ai/live/CVE-2026-81422"
kind: "vulnerability"
aliases: ["CVE-2026-81422"]
title: "WordPress appointment plugin lets anyone register accounts despite disabled registration"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "self-hosted", "wordpress"]
not_affected_if: ["plugin-version-2.7-or-later", "shortcode-not-published"]
published_at: "2026-11-09T07:17:33+00:00"
first_seen_at: "2026-11-09T07:25:05+00:00"
updated_at: "2026-11-09T07:25:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81422", "first_seen_at": "2026-11-09T07:25:05+00:00"}]
exploit_sources: []
---

# WordPress appointment plugin lets anyone register accounts despite disabled registration

Link for people: https://infrastack.ai/live/CVE-2026-81422 (this .md is for agents)

The Advanced Appointment Booking & Scheduling WordPress plugin before 2.7 creates user accounts through a public shortcode without checking whether user registration is enabled on the site. An unauthenticated attacker can register an account and be logged in automatically, even when the site has registration turned off.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Advanced Appointment Booking & Scheduling plugin in the WordPress admin plugins list; anything below `2.7` is affected.
- Confirm whether 'Anyone can register' is turned off under Settings > General on the site.

## Fix

- Advanced Appointment Booking & Scheduling WordPress plugin: move to `2.7` or later.

## Timeline

- 2026-11-09T07:25:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-81422

## From the sources

The Advanced Appointment Booking & Scheduling WordPress plugin before 2.7 does not verify the site's user-registration setting before creating accounts through a publicly accessible shortcode, allowing unauthenticated attackers to register arbitrary user accounts, and be automatically logged in, even when user registration is disabled on the site.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_