CVE-2026-86475: Unknown Appointment Hour Booking

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The Appointment Hour Booking WordPress plugin before 1.5.95 does not check every appointment in a booking submission against the capacity configured for its own slot, allowing unauthenticated visitors to take slots that are already fully booked.

Affected products

• Unknown Appointment Hour Booking: before 1.5.95 (fixed in 1.5.95)

Published 2026-09-16. Last modified 2026-09-16.