CVE-2026-11866 describes a CSRF vulnerability in the Appointment Booking Plugin for WordPress prior to version 5.6.3. The plugin's central request dispatcher fails to validate a CSRF nonce on multiple state-changing operations. As a result, an attacker can exploit this flaw by crafting malicious requests that a logged-in administrator might unwittingly execute, leading to unauthorized changes like modifying booking form settings or disconnecting payment gateways.

An attacker can perform privileged actions without proper authorization by exploiting the CSRF vulnerability, potentially disrupting booking configurations and payment gateway connectivity. This can affect the integrity and availability of the booking system managed by the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid performing sensitive actions while browsing untrusted sites and consider implementing additional CSRF protections or restricting administrative access.