CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in Roland Murg WP Booking System wp-booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Booking System: from n/a through <= 2.0.19.2.
Explanation of Vulnerability in Simple Terms
WP Booking System versions 2.0.19.2 and earlier lack proper authorization checks, allowing authenticated users to modify booking data they should not have access to. An attacker with a low-privilege account can alter bookings belonging to other users or administrators. The vulnerability requires valid site credentials but no additional user interaction.
What an attacker can do
Modify or tamper with bookings belonging to other users or administrators.
Potential impact on your site
Booking data integrity is compromised; users can alter reservations they don't own.
Conditions required to exploit
Attacker must have a valid low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
