CVE-2026-105197

{
  "etk_id": "ETK-2026-1449",
  "cve_id": "CVE-2026-105197",
  "display_id": "CVE-2026-105197",
  "ghsa_id": "GHSA-gr76-mf2h-68h2",
  "euvd_id": "EUVD-2026-94769",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Improper record authorization in Appointment Booking Plugin",
  "summary": "Appointment Booking Plugin versions before 5.6.5 do not enforce per-record authorization for certain backend deletion actions. An authenticated staff user whose access is intended to be limited to specific records may delete orders, customers, or transactions outside that scope.",
  "mitigation": "Upgrade Appointment Booking Plugin to version 5.6.5 or later. Until upgraded, limit backend staff access to trusted users and review deletion permissions and activity.",
  "vendor": null,
  "product": "Appointment Booking Plugin",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 5.6.5"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "5.6.5"
      ],
      "package_name": "Appointment Booking Plugin",
      "purl": null
    }
  ],
  "cwes": [
    639
  ],
  "cvss_score": 2.7,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
  "epss_score": 0.0017,
  "epss_percentile": 0.0581,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 15.358448183333334,
  "t0_at": "2026-10-08T06:00:07.266000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-08T06:00:07.266000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T06:00:07.266000+00:00",
      "url": "https://github.com/advisories/GHSA-gr76-mf2h-68h2"
    }
  }
}