Medium · 6.5 CVE-2026-66679 EUVD-2026-60933GHSA-j37p-88hf-r5j6

WordPress Appointment Hour Booking plugin <= 1.5.91 - Broken Access Control vulnerability

Published Aug 18, 2026 · Updated Aug 18, 2026 · Assigned by Patchstack

Vendor: codepeople Product: Appointment Hour Booking

Description

Unauthenticated Broken Access Control in Appointment Hour Booking <= 1.5.91 versions.

Affected products

Vendor	Product	Affected	Fixed
codepeople	Appointment Hour Booking	≤ 1.5.91	—

References

https://patchstack.com/database/wordpress/plugin/appointment-hour-booking/vulnerability/wordpress-appointment-hour-booking-plugin-1-5-91-broken-access-control-vulnerability?_s_id=cve vdb-entry