CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
Server-Side Request Forgery (SSRF) vulnerability in Wappointment Appointment Bookings for Zoom GoogleMeet and more – Wappointment.This issue affects Appointment Bookings for Zoom GoogleMeet and more – Wappointment: from n/a through 2.6.0.
Explanation of Vulnerability in Simple Terms
Wappointment versions up to 2.6.0 contain a server-side request forgery vulnerability that allows high-privilege users to make the site send requests to internal or external systems on their behalf. The attacker must have administrative access and the scope of impact extends beyond the vulnerable component. This could expose internal services or be used to interact with external APIs without authorization.
What an attacker can do
Make the site send HTTP requests to internal or external systems on the attacker's behalf.
Potential impact on your site
An admin account holder can probe your internal network, interact with external APIs, or exfiltrate data via forced requests.
Conditions required to exploit
Attacker must have high-level administrative privileges; no user interaction required.
Key dates
External resources
Related vulnerabilities
