CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Booking & Appointment Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_google_calendar_data' function in versions up to, and including, 6.9.0. This makes it possible for authenticated attackers, with subscriber-level permissions or above to update the site options arbitrarily.
Explanation of Vulnerability in Simple Terms
The Booking & Appointment Plugin for WooCommerce versions up to 6.9.0 contains an improper access control vulnerability. An authenticated user with low privileges can read, modify, or delete sensitive data and functionality within the plugin. This affects confidentiality, integrity, and availability of booking and appointment data. Update to a version newer than 6.9.0 to resolve this issue.
What an attacker can do
Read, modify, or delete booking and appointment data without proper authorization.
Potential impact on your site
Booking data, customer information, and appointment records can be compromised or deleted by low-privilege users.
Conditions required to exploit
Attacker must have a low-privilege user account on the WordPress site.
Key dates
External resources
Related vulnerabilities
