CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_logout_callback function in versions up to, and including, 4.2.10. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to logout a vctia connected account which would cause a denial of service on the appointment scheduler.
Explanation of Vulnerability in Simple Terms
The vcita Online Booking & Scheduling Calendar plugin for WordPress does not properly check user permissions before allowing certain actions. A logged-in user with low privileges can modify or delete data they should not have access to. This affects versions up to 4.2.10. Site administrators should update the plugin to a version newer than 4.2.10.
What an attacker can do
A low-privilege user can modify or delete booking and scheduling data without proper authorization.
Potential impact on your site
Unauthorized users can corrupt or delete booking records, disrupting your scheduling system and customer data.
Conditions required to exploit
Attacker must have a low-privilege WordPress account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
