CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in BoxyStudio Booked - Appointment Booking for WordPress | Calendars.This issue affects Booked - Appointment Booking for WordPress | Calendars: from n/a before 2.4.4.
Explanation of Vulnerability in Simple Terms
The Booked appointment booking plugin for WordPress exposes sensitive information to unauthenticated users. An attacker can read data that should be restricted without needing to log in or interact with a site owner. Update to version 2.4.4 or later to fix this vulnerability.
What an attacker can do
Read sensitive information from the plugin without authentication.
Potential impact on your site
Appointment booking data and other plugin information may be visible to anyone visiting your site.
Conditions required to exploit
Network access to the WordPress site; no login or user interaction required.
Key dates
External resources
Related vulnerabilities
