CVE-2026-4807 describes a missing authorization vulnerability (CWE-862) in the Appointment Booking Calendar plugin for WordPress. The issue arises from the nonce_permissions_check() method, which improperly validates requests by falling back to a publicly exposed site-wide nonce (public_nonce) when the X-WP-Nonce header validation fails. This public_nonce is accessible to unauthenticated users through the /wp-json/ssa/v1/embed-inner endpoint. Consequently, attackers can use this nonce to bypass authorization checks on endpoints that delete or view appointments, enabling unauthorized viewing, modification, or deletion of appointments across the system.

Exploitation allows unauthenticated attackers to access sensitive appointment details, including public_edit_url values, and to delete or modify any appointment by ID. This results in disclosure of sensitive data, potential loss of booking records, and disruption of appointment services. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and high availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, restrict access to the affected REST API endpoints if possible, or disable the plugin if feasible to prevent exploitation. Monitor vendor channels for updates and apply official fixes promptly once released.