PT-2026-8057 · WordPress · Bookr

Bssoftware · Published 2026-02-14 · Updated 2026-02-14 · CVE-2026-1932

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Bookr versions up to and including 1.0.2

Description The Bookr plugin for WordPress has a flaw that allows unauthorized modification of data. This is due to a missing capability check on the update-appointment API endpoint. Unauthenticated attackers can change the status of any appointment.

Recommendations Update the Bookr plugin to a version newer than 1.0.2.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-1932

Affected Products

Bookr

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-1932 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/2ab4baab-9e91-4ed5-9749-4a14e8180e71?source=cve · Note
• https://twitter.com/CVEarity/status/2022679407765422531 · Twitter Post
• https://plugins.trac.wordpress.org/browser/bookr/tags/1.0.2/includes/rest-api/controller/appointment-controller.php#L47 · Note
• https://plugins.trac.wordpress.org/browser/bookr/trunk/includes/rest-api/controller/appointment-controller.php#L47 · Note
• https://twitter.com/VulmonFeeds/status/2022568577094635775 · Twitter Post
• https://twitter.com/CVEnew/status/2022553159650926643 · Twitter Post
• https://t.me/cveNotify/152023 · Telegram Post