Description

WordPress Plugin Appointment Booking Calendar and Online Scheduling-BookingPress is prone to a insecure direct object reference (IDOR) vulnerability. Exploiting this issue may allow an attacker to view information about any booking, including full name, date, time and service booked. WordPress Plugin Appointment Booking Calendar and Online Scheduling-BookingPress version 1.0.30 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 1.0.31 or latest

References

https://sploitus.com/exploit?id=WPEX-ID:8A7BD9F6-2789-474B-A237-01C643FDFBA7

Related Vulnerabilities

Jenkins Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-21608)

WordPress Plugin Login/Signup Popup (Inline Form + Woocommerce) Security Bypass (2.7.2)

WordPress Plugin WP Statistics Cross-Site Scripting (12.6.5)

Liferay Portal Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2023-33945)

PHP Out-of-bounds Read Vulnerability (CVE-2020-7061)

Severity

High

Classification

CVE-2022-4340 CWE-639 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update