CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking calendar, Appointment Booking System: from n/a through <= 3.2.36.
Explanation of Vulnerability in Simple Terms
The Booking Calendar plugin for WordPress contains an authorization bypass that allows unauthenticated attackers to modify booking data. The vulnerability stems from missing permission checks on certain API endpoints. An attacker can alter appointment records without authentication, potentially disrupting bookings or manipulating scheduling information.
What an attacker can do
Modify or tamper with booking and appointment records without logging in.
Potential impact on your site
Attackers can alter or corrupt appointment data, disrupting your booking system and customer trust.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
