CVE-2026-5693 identifies a missing authorization vulnerability (CWE-862) in the Smart Appointment & Booking WordPress plugin by zealopensource. The flaw resides in the saab_cancel_booking() function where a nonce validation logic error uses && instead of ||, effectively bypassing the nonce check when any security parameter is present. This logic error, combined with the absence of capability checks, permits unauthenticated attackers to cancel bookings arbitrarily by supplying predictable booking IDs. The vulnerability affects all versions up to and including 1.0.8. No official patch or remediation guidance is currently available.

The vulnerability allows unauthenticated attackers to modify booking data by canceling arbitrary bookings without authorization. There is no impact on confidentiality or availability, but the integrity of booking data is compromised. This could disrupt appointment scheduling and cause operational issues for affected WordPress sites using this plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the booking cancellation feature or restricting access to trusted users only. Monitoring for unusual booking cancellations may help detect exploitation attempts.