CVE-2026-105196: CWE-639 Authorization Bypass Through User-Controlled Key in Appointment Booking Plugin

The Appointment Booking Plugin WordPress plugin versions prior to 5.6.9 fail to enforce proper per-record authorization checks on multiple AI Abilities API actions. This authorization flaw permits authenticated users assigned the LatePoint Agent role—intended to restrict access to their own records—to access and modify other agents' profile information and to read other agents' bookings and related customer data when the Abilities API feature is active.

An authenticated user with the LatePoint Agent role can access and modify data beyond their authorized scope, including other agents' profile data and bookings with customer details. This could lead to unauthorized disclosure and modification of sensitive agent and customer information within the plugin environment.

Upgrade the Appointment Booking Plugin to version 5.6.9 or later, where this authorization issue is fixed. Since no vendor advisory or patch link is provided, confirm the availability of this update from the official plugin source before applying. Until patched, consider disabling the Abilities API feature if feasible to reduce exposure.