{"affected":[{"defaultStatus":"unaffected","product":"Advanced Appointment Booking & Scheduling","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"2.7","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-81422","cwes":["CWE-862"],"description":"The Advanced Appointment Booking & Scheduling WordPress plugin before 2.7 does not verify the site's user-registration setting before creating accounts through a publicly accessible shortcode, allowing unauthenticated attackers to register arbitrary user accounts, and be automatically logged in, even when user registration is disabled on the site.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/05f00d47-0014-456b-ade8-994113b5507c/"}],"kev":null,"metrics":[],"modifiedAt":1794204029344,"publishedAt":1794204029344,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/05f00d47-0014-456b-ade8-994113b5507c/"}],"remediation":[],"revision":"0eaab825788211ace66c1da2780b900b1345fffc408488d6aa6465c328c1dc9c","sources":[{"modifiedAt":1794204029344,"name":"CNA: WPScan","retrievedAt":1794208142301,"url":"https://www.cve.org/CVERecord?id=CVE-2026-81422"}],"ssvc":null,"status":"published","title":"Advanced Appointment Booking & Scheduling < 2.7 - Unauthenticated Arbitrary User Registration","updatedAt":1794208142301}