CVE-2026-1704 | croixhaug Appointment Booking Calendar Plugin up to 1.6.9.29 on WordPress get_item_permissions_check ID authorization

A vulnerability was found in croixhaug Appointment Booking Calendar Plugin up to 1.6.9.29 on WordPress. It has been rated as problematic. The impacted element is the function get_item_permissions_check. The manipulation of the argument ID leads to authorization bypass.

This vulnerability is traded as CVE-2026-1704. It is possible to initiate the attack remotely. There is no exploit available.