What the vulnerability does
01Description
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_save_settings_callback function in versions up to, and including, 4.4.6. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to modify the plugins settings, upload arbitrary files, and inject malicious JavaScript (before 4.3.2).
Explanation of Vulnerability in Simple Terms
02Summary
The vcita Online Booking & Scheduling Calendar plugin for WordPress versions up to 4.4.6 lacks proper authorization checks on certain functions. A logged-in user with low privileges can modify or delete booking data without proper permission verification. The plugin does not validate user roles before allowing these actions, enabling privilege escalation within the booking system.
What an attacker can do
03Attacker Capabilities
A logged-in user can modify or delete booking data they should not have access to.
Potential impact on your site
04Site Impact
Booking data integrity is at risk; users may lose or have their appointments altered by unauthorized account holders.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor role).
Key dates
06Disclosure timeline
June 9, 2023
CVE published
April 8, 2026
Record updated
