CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in BuddhaThemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WeDesignTech Ultimate Booking Addon: from n/a through <= 1.0.3.
Explanation of Vulnerability in Simple Terms
WeDesignTech Ultimate Booking Addon versions 1.0.3 and earlier lack proper authorization checks, allowing authenticated users to modify or delete booking data they should not access. An attacker with a low-privilege account can alter bookings or availability settings. Update to a version newer than 1.0.3.
What an attacker can do
Modify or delete bookings and availability data belonging to other users or the site.
Potential impact on your site
Booking data integrity compromised; customers' reservations can be altered or erased by unauthorized users.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
