PT-2026-8057 · WordPress · Bookr

Bssoftware · Publicado 2026-02-14 · Atualizado 2026-02-14 · CVE-2026-1932

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Bookr versions up to and including 1.0.2

Description The Bookr plugin for WordPress has a flaw that allows unauthorized modification of data. This is due to a missing capability check on the update-appointment API endpoint. Unauthenticated attackers can change the status of any appointment.

Recommendations Update the Bookr plugin to a version newer than 1.0.2.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-1932

Produtos afetados

Bookr

Referências · 8

• https://wordfence.com/threat-intel/vulnerabilities/id/2ab4baab-9e91-4ed5-9749-4a14e8180e71?source=cve · Nota
• https://twitter.com/CVEarity/status/2022679407765422531 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/bookr/tags/1.0.2/includes/rest-api/controller/appointment-controller.php#L47 · Nota
• https://plugins.trac.wordpress.org/browser/bookr/trunk/includes/rest-api/controller/appointment-controller.php#L47 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-1932 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2022568577094635775 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2022553159650926643 · Publicação no Twitter
• https://t.me/cveNotify/152023 · Publicação no Telegram