CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in CodePeople Booking Calendar Contact Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking Calendar Contact Form: from n/a through 1.2.34.
Explanation of Vulnerability in Simple Terms
Booking Calendar Contact Form versions up to 1.2.34 lack proper authorization checks on certain operations. An authenticated user with low privileges can modify data they should not have access to. The vulnerability requires a valid user account but no special interaction from the victim.
What an attacker can do
Modify booking or form data belonging to other users or the site.
Potential impact on your site
Unauthorized changes to bookings or contact form submissions by authenticated users.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
