CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Unrestricted Upload of File with Dangerous Type vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Using Malicious Files.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through <= 4.5.3.
Explanation of Vulnerability in Simple Terms
The vcita Online Booking & Scheduling Calendar plugin for WordPress allows authenticated users with high privileges to upload files without proper validation. An attacker with admin or equivalent access can upload malicious files to the server, potentially gaining the ability to run their own code on the site. The vulnerability affects all versions up to 4.5.3.
What an attacker can do
Upload malicious files and run their own code on the WordPress site.
Potential impact on your site
A compromised admin account could lead to full site takeover, data theft, or malware installation.
Conditions required to exploit
Attacker must have high-level admin or equivalent privileges on the WordPress site.
Key dates
External resources
Related vulnerabilities
