CVE-2026-9188 describes an insecure direct object reference vulnerability in the Wappointment plugin for WordPress. The plugin uses an edit key for appointment authorization, generated as a predictable, unsalted MD5 hash of client_id (sequential integer), start_at (public timestamp), and staff_id (small enumerable integer). Because the key is predictable and no additional ownership or identity verification is performed, unauthenticated attackers can compute valid keys for other users' appointments and cancel or reschedule them via REST endpoints. Exploitation requires that the site has cancellation or rescheduling enabled, which are common configurations. The vulnerability affects all versions up to and including 2.7.6. No patch or official fix is currently documented.

An attacker can bypass authorization controls to cancel or reschedule appointments belonging to other users without authentication. This results in unauthorized modification of appointment data (integrity impact) but does not disclose confidential information or cause denial of service. The impact is limited to integrity loss of appointment bookings.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling the allow_cancellation and allow_rescheduling settings to prevent exploitation. Monitor for updates from the vendor regarding patches or official mitigations.