Description
WordPress Plugin Appointment Booking Calendar and Online Scheduling-BookingPress is prone to a insecure direct object reference (IDOR) vulnerability. Exploiting this issue may allow an attacker to view information about any booking, including full name, date, time and service booked. WordPress Plugin Appointment Booking Calendar and Online Scheduling-BookingPress version 1.0.30 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 1.0.31 or latest
References
Related Vulnerabilities
WordPress Plugin ListingPro SQL Injection (2.9.3)
WordPress Plugin BackupBuddy Multiple Vulnerabilities (8.0.1.8)
WordPress Plugin Podcast Importer SecondLine SQL Injection (1.3.7)
PrestaShop URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2020-5270)
WordPress Plugin Count per Day Multiple Cross-Site Scripting Vulnerabilities (3.5.4)