CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized medication of data via the /wp-json/vcita-wordpress/v1/actions/auth REST-API endpoint in versions up to, and including, 4.4.2 due to a missing capability check on the processAction function. This makes it possible for unauthenticated attackers modify the plugin's settings.
Explanation of Vulnerability in Simple Terms
The vcita Online Booking & Scheduling Calendar plugin for WordPress versions up to 4.4.2 lacks proper authorization checks on certain functions. An unauthenticated attacker can modify data without permission. Update to a version newer than 4.4.2 to resolve this issue.
What an attacker can do
Modify plugin data without authentication or authorization.
Potential impact on your site
Booking data, calendar entries, or plugin settings could be altered by unauthorized users.
Conditions required to exploit
Network access to the WordPress site; no authentication required.
Key dates
External resources
Related vulnerabilities
