graph LR
    A[Attacker<br/>Remote, Unauth] -->|HTTP GET/POST| B{WordPress REST API}
    B -->|/wp-json/bookingpress/v1/*| C{Permission Check}
    C -->|❌ Callback Bypassed| D[Customer PII Disclosure]
    C -->|❌ Callback Bypassed| E[Booking Data Tampering]
    C -->|✅ Proper Fix| F[401 Unauthorized]
    
    style A fill:#ff4444,color:#fff
    style D fill:#ff8800,color:#fff
    style E fill:#ff8800,color:#fff
    style F fill:#44bb44,color:#fff

flowchart TD
    subgraph "🔴 Vulnerable Code (< 5.7.3)"
        A1[register_rest_route] --> A2[permission_callback<br/>❌ Not correctly invoked]
        A2 --> A3[Callback returns null/falsey]
        A3 --> A4[WordPress treats as 'permitted']
        A4 --> A5[🔓 Unauthenticated Access]
    end
    
    subgraph "🟢 Patched Code (5.7.3+)"
        B1[register_rest_route] --> B2[permission_callback<br/>✅ Properly invoked]
        B2 --> B3[current_user_can check]
        B3 --> B4{Authorized?}
        B4 -->|Yes| B5[✅ Access Granted]
        B4 -->|No| B6[🔒 401 Unauthorized]
    end
    
    A5 -->|Impact| C1[📤 Customer PII Exposure]
    A5 -->|Impact| C2[✏️ Booking Data Modification]
    A5 -->|Impact| C3[🚫 Appointment Cancellation]
    
    style A2 fill:#ff4444,color:#fff
    style B2 fill:#44bb44,color:#fff
    style A5 fill:#ff8800,color:#fff
    style C1 fill:#ff8800,color:#fff
    style C2 fill:#ff8800,color:#fff
    style C3 fill:#ff8800,color:#fff

pie title Estimated Installation Distribution
    "Health & Wellness" : 25
    "Salon & Lifestyle" : 20
    "Medical & Clinics" : 15
    "Professional Services" : 15
    "Fitness & Gyms" : 10
    "Education" : 10
    "Other" : 5