CVE-2026-9830 describes an improper authentication vulnerability in the bookingpress-appointment-booking-pro WordPress plugin prior to version 5.7.3. The plugin fails to correctly invoke its REST permission callback, which leads to all routes in a specific API namespace being accessible without authentication. This allows unauthenticated attackers to read sensitive customer booking information and modify bookings belonging to other users. The vulnerability is categorized under CWE-287 and has a CVSS v3.1 base score of 8.2, indicating high severity. No patch or official remediation guidance is currently provided, and no known exploits are reported in the wild.

Unauthenticated attackers can access and read customer booking data and modify bookings of other users via the plugin's API. This compromises confidentiality and integrity of booking information but does not affect availability. The high CVSS score reflects the ease of exploitation (network attack vector, no privileges or user interaction required) and the significant confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor for updates from the vendor and apply any released patches promptly. Until a fix is available, consider restricting access to the affected API namespace or disabling the plugin if feasible to prevent exploitation.