CVE-2026-81422
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Nov 09, 2026
Vendor
unknown
Description
The Advanced Appointment Booking & Scheduling WordPress plugin before 2.7 does not verify the site's user-registration setting before creating accounts through a publicly accessible shortcode, allowing unauthenticated attackers to register arbitrary user accounts, and be automatically logged in, even when user registration is disabled on the site.