Unauthenticated REST API Access in BookingPress Plugin

The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other users' bookings.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

BookingPress Appointment Booking Pro before version 5.7.3 contains a critical authentication bypass vulnerability where REST API endpoints fail to properly enforce permission callbacks. This allows unauthenticated attackers to access sensitive customer booking data and modify other users' reservations without any credentials. The vulnerability affects WordPress installations using this popular appointment scheduling plugin, potentially impacting businesses relying on BookingPress for client management, scheduling, and payment processing. With a CVSS score of 8.2, this vulnerability poses significant risk to data confidentiality and integrity across affected WordPress environments.

Casky.ai's platform identifies attack patterns aligned with MITRE ATT&CK's TA0004 (Privilege Escalation) and TA0006 (Credential Access) techniques by analyzing 283 mapped security skills. Practitioners would detect exploitation attempts through findings showing: unauthorized REST endpoint access without valid authentication tokens (credential access patterns), privilege escalation through API calls that bypass role-based access controls, and anomalous booking data modifications originating from unauthenticated sources. Claude AI's extended reasoning capabilities enable detection of the logical flow between missing permission callbacks and unauthorized data access, surfacing attack chains that might appear as isolated API requests but represent coordinated reconnaissance and data exfiltration activities targeting customer information.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-9830.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-9830

Casky has 283 skills that investigate the attack patterns behind CVE-2026-9830. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn