CVE-2024-5071
Bookster <= 1.1.0 - Unauthenticated Appointment Status Update
- State
- Published
- Severity
- 6.5 Medium
- Published
- Jun 26, 2024
- Updated
- Oct 28, 2024
- Reserved
- May 17, 2024
Description
The Bookster WordPress plugin through 1.1.0 allows adding sensitive parameters when validating appointments allowing attackers to manipulate the data sent when booking an appointment (the request body) to change its status from pending to approved.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N | CISA-ADP |
Weaknesses
- CWE-863 Incorrect Authorization
Affected Products
| Product | Versions |
|---|---|
BooksterUnknown |
|
References
- https://wpscan.com/vulnerability/07b293cf-5174-45de-8606-a782a96a35b3/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.