CVE-2026-91847
Last modified
CVE-2026-91847 is a medium-severity vulnerability rated 4.8/10 on the CVSS scale. The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-assistant conversation named in its unauthenticated conversation actions, allowing any unauthenticated visitor to read another visitor's assistant messages and to inject messages into their in-progress conversation.. EPSS estimates a 0.14% chance of exploitation in the next 30 days.
Description
The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-assistant conversation named in its unauthenticated conversation actions, allowing any unauthenticated visitor to read another visitor's assistant messages and to inject messages into their in-progress conversation.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Online Scheduling and Appointment Booking System | >= 28.1, < 28.2 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-91847?
How severe is CVE-2026-91847?
How do I fix CVE-2026-91847?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-9184The 24liveblog - live blog tool plugin for WordPress is vuln…4.3
- CVE-2026-91840A flaw was found in NetworkManager-vpnc. This vulnerability …7.8
- CVE-2026-91841A flaw was found in NetworkManager-vpnc, a VPN plugin for Ne…7.8
- CVE-2026-91842A vulnerability has been found in OpenBankProject OBP-API up…4.1
- CVE-2026-91843A stack overflow during the unauthenticated login process ma…9.8
- CVE-2026-91846Affected versions of MISP allow a collection element to be c…7.1
- CVE-2026-91848A vulnerability was identified in WuzhiCMS up to 4.1.0. Affe…7.3
- CVE-2026-91849A security flaw has been discovered in WuzhiCMS up to 4.1.0.…6.3
- CVE-2026-9185The 6Storage Rentals plugin for WordPress is vulnerable to A…7.5
- CVE-2026-91851Affected versions of MISP incorrectly filter dashboard templ…5.3
- CVE-2026-91852Improper neutralization of input during web page generation …6.1
- CVE-2026-91853A vulnerability has been found in TOTOLINK X5000R 9.1.0cu.20…7.4
Are you affected by CVE-2026-91847?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST