CVE-2026-81422: Advanced Appointment Booking & Scheduling < 2.7 - Unauthenticated Arbitrary User Registration

Q: Who is exposed to this issue?

Sites using the Advanced Appointment Booking & Scheduling WordPress plugin at a version before 2.7 are exposed if the vulnerable publicly accessible shortcode is available. The site can be affected even when WordPress user registration is disabled.

Q: What does an attacker need to exploit it?

An attacker does not need to authenticate. They can use the publicly accessible shortcode to create an arbitrary user account and are automatically logged in to that account.

Q: Does disabling WordPress user registration prevent exploitation?

No. The vulnerable plugin does not verify the site's user-registration setting before creating accounts through the shortcode.

Q: How can I determine whether my site may already have been affected?

Review WordPress user accounts for unexpected registrations, particularly accounts created while site-wide user registration was disabled. Also verify whether the plugin version is earlier than 2.7.

Q: What should be done if updating is not immediately possible?

Restrict public access to the affected shortcode and monitor or remove unauthorized accounts. Upgrade the plugin to version 2.7 or later when possible.

Published Nov 9, 2026

Updated

The Advanced Appointment Booking & Scheduling WordPress plugin before 2.7 does not verify the site's user-registration setting before creating accounts through a publicly accessible shortcode, allowing unauthenticated attackers to register arbitrary user accounts, and be automatically logged in, even when user registration is disabled on the site.

Affected Software

1 affected component

A WP Life Advanced Appointment Booking & Scheduling<2.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Advanced Appointment Booking & Scheduling to a version that resolves this vulnerability.
Fixed in 2.7

Event History

Nov 9, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

Description

Frequently Asked Questions

Who is exposed to this issue?

Sites using the Advanced Appointment Booking & Scheduling WordPress plugin at a version before 2.7 are exposed if the vulnerable publicly accessible shortcode is available. The site can be affected even when WordPress user registration is disabled.

What does an attacker need to exploit it?

An attacker does not need to authenticate. They can use the publicly accessible shortcode to create an arbitrary user account and are automatically logged in to that account.

Does disabling WordPress user registration prevent exploitation?

No. The vulnerable plugin does not verify the site's user-registration setting before creating accounts through the shortcode.

How can I determine whether my site may already have been affected?

Review WordPress user accounts for unexpected registrations, particularly accounts created while site-wide user registration was disabled. Also verify whether the plugin version is earlier than 2.7.

What should be done if updating is not immediately possible?

Restrict public access to the affected shortcode and monitor or remove unauthorized accounts. Upgrade the plugin to version 2.7 or later when possible.

CVE-2026-81422: Advanced Appointment Booking & Scheduling < 2.7 - Unauthenticated Arbitrary User Registration

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Does disabling WordPress user registration prevent exploitation?

How can I determine whether my site may already have been affected?

What should be done if updating is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Does disabling WordPress user registration prevent exploitation?

How can I determine whether my site may already have been affected?

What should be done if updating is not immediately possible?