CVE-2026-9188: Wappointment Predictable Edit Key Insecure Direct Object Reference

Technical summary

Wappointment generates the `edit_key` authorization token as an unsalted MD5 hash of three inputs: `client_id` (a sequential integer), `start_at` (the appointment timestamp, visible in public calendars or booking confirmations), and `staff_id` (typically a small, enumerable identifier). The REST endpoints for cancellation and rescheduling (`tryCancel()` and related functions) accept the `appointmentkey` parameter and verify ownership solely by matching this reconstructed key, with no additional authentication or identity checks. Because all three inputs are either public or easily enumerable, an attacker can perform offline computation to generate valid keys for arbitrary appointments. An attacker observing their own booked appointment reveals the `client_id` sequence pattern and timing behavior, allowing them to enumerate and target other users' slots. Exploitation requires that `allow_cancellation` or `allow_rescheduling` are enabled—common defaults for active booking sites.

Business impact

Organizations using Wappointment face disruption to service delivery through unauthorized appointment cancellations and rescheduling. For service providers (consultants, health practitioners, salons, training facilities), attackers can sabotage schedules, damage customer trust, and cause revenue loss. Customer data is not at immediate risk, but the integrity and availability of the booking system is severely compromised. If rescheduling is enabled, an attacker can also redirect appointments to attacker-controlled time slots, creating confusion and operational friction.

Affected systems

WordPress sites using the Appointment Bookings for Zoom GoogleMeet and more – Wappointment plugin in versions 2.7.6 and earlier are vulnerable. The plugin integrates with video conferencing platforms (Zoom, Google Meet, etc.) for appointment scheduling. Vulnerability is active only if `allow_cancellation` or `allow_rescheduling` is enabled in the plugin settings; however, these features are typical in production booking deployments and are not opt-in security hardening measures.

Exploitability

Exploitation is straightforward and requires no specialized tools. An attacker needs only the ability to make HTTP requests to the REST endpoints. Discovering target appointments is trivial: an attacker can book their own appointment to learn the `client_id` sequence, then use publicly visible or easily inferred appointment times and staff IDs to brute-force or enumerate valid keys. No authentication, special privileges, or user interaction is required. The attack surface is high because the endpoints are unauthenticated and the inputs to the key-generation algorithm are all guessable or public. Automated tooling could easily batch-cancel or reschedule multiple appointments.

Remediation

Upgrade to a patched version of Wappointment that implements cryptographically secure, random authorization tokens (e.g., using random bytes rather than deterministic hashing) and includes proper identity verification. If patching is delayed, disable the `allow_cancellation` and `allow_rescheduling` options in plugin settings to prevent exploitation; users can then cancel or reschedule through authenticated, admin-controlled interfaces only. Additionally, audit recent appointment changes for suspicious cancellations or time shifts.

Patch guidance

Consult the Wappointment plugin repository and vendor advisories for a patched version beyond 2.7.6. Verify the fix addresses the use of random, high-entropy tokens for the `edit_key` and confirms that authorization checks include additional identity or ownership verification (e.g., email validation, session binding, or CSRF tokens). Apply the patch immediately through the WordPress admin panel. Test that legitimate customer cancellations and reschedulings still function and that previously issued links are invalidated after the update.

Detection guidance

Monitor logs for unusual patterns in the REST API endpoints `/appointment/reschedule` and `/appointment/cancel`. Look for clusters of requests with different `appointmentkey` values targeting appointments within a short timeframe, a sign of key enumeration. Correlate successive booking requests from the same IP with rapid cancellations of other users' appointments. Log and alert on any cancellation or reschedule operation originating from an unauthenticated session or IP range. Review appointment change logs for time shifts to off-hours or deletions of high-value service slots (e.g., premium consultation times). If available, enable verbose logging of the `appointmentkey` parameter to track failed authorization attempts.

Why prioritize this

Although the CVSS score is MEDIUM (5.3), the impact to operational continuity and customer trust is substantial. The attack requires no authentication, no user interaction, and minimal effort, making it accessible to unsophisticated attackers and bots. For businesses relying on Wappointment for revenue or service scheduling, this should be treated as a high operational priority. The fix is software-specific and straightforward, but delay creates ongoing exposure to appointment sabotage. Organizations with high-value or capacity-constrained services (healthcare, legal, training) should prioritize patching within 7–14 days.

Risk score, explained

The CVSS 5.3 MEDIUM score reflects the integrity impact of unauthorized appointment manipulation and the absence of confidentiality or availability concerns (appointments are not destroyed, merely rescheduled or cancelled). The network attack vector, low attack complexity, and no privilege requirement elevate the score. However, the practical severity exceeds the numeric score because an attacker can cause repeated, targeted disruption to business operations with ease and minimal detection risk. User interface limitations (the feature must be enabled) slightly reduce CVSS, but both cancellation and rescheduling are common settings in production. Organizations should consider this a practical HIGH priority despite the MEDIUM CVSS label.

Frequently asked questions