CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in QuanticaLabs Car Park Booking System for WordPress car-park-booking-system-for-wordpress.This issue affects Car Park Booking System for WordPress: from n/a through <= 2.6.
Explanation of Vulnerability in Simple Terms
The Car Park Booking System for WordPress plugin through version 2.6 lacks proper authorization checks on certain functions. A logged-in user with low privileges can modify booking data or system settings they should not have access to. The vulnerability requires an active WordPress account but no special interaction from other users.
What an attacker can do
Modify booking records or system settings without proper permission.
Potential impact on your site
Unauthorized users can alter car park bookings or plugin configuration, disrupting service and potentially causing financial loss.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or customer role).
Key dates
External resources
Related vulnerabilities
