CVE-2025-46247 is a medium severity missing authorization flaw (CVSS 5.3) in the CodePeople Appointment Booking Calendar WordPress plugin, versions through 1.3.92. The record names no fixed version. Update to a newer release, confirm the fix in the changelog or Patchstack entry, or remove the plugin.
What's affected
The record lists the Appointment Booking Calendar plugin, slug appointment-booking-calendar, from the earliest release through version 1.3.92. It says the weakness allows accessing functionality that is not properly constrained by access control lists.
The record gives no fixed version. The impact rating is on availability (low), not on confidentiality or integrity, so the likely effect is disruption of the booking function rather than data theft. Confirm that with the vendor changelog.
How to check if you're exposed
Check the installed version on each site.
- In the WordPress admin, open Plugins and read the version of Appointment Booking Calendar.
- With WP-CLI, run the command shown below.
- Compare the version with 1.3.92. Anything at or below it is in the affected range.
- Review the booking data on the site for unexpected changes, deleted slots or missing appointments.
If the plugin is installed but unused, treat it as exposed anyway.
Commands referred to above, in order:
wp plugin list --name=appointment-booking-calendar --fields=name,version,status
What to do now
- Find every site that runs Appointment Booking Calendar and note its version.
- Update to the newest release and read the changelog for an authorization fix.
- Delete the plugin if you no longer use it.
- Check recent bookings and settings for changes you did not make.
- Back up the booking data before any update so you can compare afterwards.
- Review your WordPress update routine so plugin updates do not wait for a monthly window.
Why it matters
The record lists CWE-862 (Missing Authorization). In WordPress, plugin functions are often reachable through admin AJAX or REST routes. If a handler forgets to check the caller's capability, anyone who can send the request can run it.
The vector rates the attack as network based with no privileges, and the effect as a low availability impact. That is why the score is 5.3 and not higher. For a business that lives on bookings, even a small disruption can cost real appointments. The record does not mark this CVE as exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
Quick check
Which versions are affected?
The record says through 1.3.92.
Does the record say what an attacker can do?
It describes access to functionality that is not properly constrained. The CVSS vector rates the impact as a low effect on availability.
Sources
Last reviewed: 18 October 2026.
