CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Easy Booking WordPress plugin before 3.5.0 does not re-enforce a bookable product's configured minimum booking duration on the server side when adding to cart and calculating the booking price, allowing unauthenticated users to place below-minimum bookings and complete underpriced orders.
Explanation of Vulnerability in Simple Terms
Easy Booking versions before 3.5.0 contain an integrity vulnerability accessible over the network without authentication or user interaction. An attacker can modify data or content on the site. The specific attack vector is unclear due to incomplete vulnerability details, but the low CVSS score suggests limited scope. Update to version 3.5.0 or later immediately.
What an attacker can do
Modify data or content on your site without logging in.
Potential impact on your site
Attackers can alter booking data, settings, or other site content without permission.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
