CVE-2026-39756

An Insecure Direct Object Reference vulnerability exists in the WordPress Wappointment plugin in versions up to and including 2.7.7. Object references are not checked for authorization, so an unauthenticated attacker can access objects that do not belong to them.

Endpoints accept object identifiers supplied by the requester without verifying that the requester owns or is permitted to access the referenced object.

Attack vector: Unauthenticated request with another object's identifier, returning data the requester should not be able to access.

• Unauthorized access to other users' data
• Confidentiality and integrity impact, per the CVSS vector (C:L/I:L)

Update Wappointment to the latest release with the IDOR fix.