Description

WordPress Plugin Appointment Booking Calendar and Online Scheduling-BookingPress is prone to a insecure direct object reference (IDOR) vulnerability. Exploiting this issue may allow an attacker to view information about any booking, including full name, date, time and service booked. WordPress Plugin Appointment Booking Calendar and Online Scheduling-BookingPress version 1.0.30 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 1.0.31 or latest

References

https://sploitus.com/exploit?id=WPEX-ID:8A7BD9F6-2789-474B-A237-01C643FDFBA7

Related Vulnerabilities

Envoy Proxy Excessive Iteration Vulnerability (CVE-2021-39204)

WordPress Plugin Klarna Checkout for WooCommerce Security Bypass (2.0.9)

Sqlite CVE-2021-20223 Vulnerability (CVE-2021-20223)

Nginx Out-of-bounds Write Vulnerability (CVE-2014-0133)

WordPress Plugin SB Uploader Arbitrary File Upload (3.2)

Severity

High

Classification

CVE-2022-4340 CWE-639 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update