The Appointment Booking Calendar plugin for WordPress up to version 1.6.10.6 suffers from a Missing Authorization vulnerability due to flawed authorization logic involving a publicly exposed site-wide nonce. This allows unauthenticated attackers to view, delete, or modify any appointment by exploiting the exposed public_nonce and bypassing proper permission checks. The vulnerability leads to disclosure of sensitive appointment data and potential service disruption.