CVE-2022-4340
BookingPress < 1.0.31 - Unauthenticated IDOR in appointment_id
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jan 2, 2023
- Updated
- Apr 10, 2025
- Reserved
- Dec 7, 2022
Description
The BookingPress WordPress plugin before 1.0.31 suffers from an Insecure Direct Object Reference (IDOR) vulnerability in it's thank you page, allowing any visitor to display information about any booking, including full name, date, time and service booked, by manipulating the appointment_id query parameter.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | CISA-ADP |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
BookingPressUnknown |
|
References
- https://wpscan.com/vulnerability/8a7bd9f6-2789-474b-a237-01c643fdfba7exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.