CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
The Scheduling Plugin – Online Booking for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'cbsb_disconnect_settings' function in all versions up to, and including, 3.5.10. This makes it possible for unauthenticated attackers to disconnect the plugin from the startbooking service and remove connection data.
Explanation of Vulnerability in Simple Terms
The Scheduling Plugin for WordPress does not properly check user permissions before allowing modifications to booking data. An unauthenticated attacker can modify or delete bookings without authorization. The vulnerability affects all versions up to 3.5.10. Site administrators should update to a version newer than 3.5.10 as soon as available.
What an attacker can do
Modify or delete bookings without logging in or having permission.
Potential impact on your site
Bookings can be altered or removed by anyone, disrupting scheduling operations and customer trust.
Conditions required to exploit
Network access to the WordPress site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
