Davidfdzmorilla

**Name of the Vulnerable Software and Affected Versions** Wappointment versions prior to 2.7.7 **Description** The plugin contains an Insecure Direct Object Reference (IDOR) flaw involving the `appointmentkey` parameter. The issue stems from the `edit key` used by the `tryCancel()` function being generated as a predictable, unsalted MD5 hash of the `client id` (a sequential integer), `start at` (a public timestamp), and `staff id` (an enumerable integer). Because the unauthenticated cancellation and rescheduling REST endpoints do not verify ownership beyond this reconstructible key, attackers can compute valid keys for other users to cancel or reschedule appointments. This exploitation is possible when the `allow cancellation` or `allow rescheduling` settings are enabled. **Recommendations** Update to a version newer than 2.7.6. As a temporary mitigation, disable the `allow cancellation` and `allow rescheduling` settings.

**Name of the Vulnerable Software and Affected Versions** BookIt versions prior to 2.5.4.1 **Description** An authentication bypass exists via an alternate path or channel, which allows for the exploitation of the password recovery process. **Recommendations** Update to version 2.5.4.1 or later.

**Name of the Vulnerable Software and Affected Versions** Elementor Website Builder versions prior to 3.35.5 **Description** An authorization issue exists in Elementor Website Builder. The issue involves exploiting incorrectly configured access control security levels. No information was provided regarding the number of potentially affected devices or any real-world incidents. The vulnerability allows bypassing intended access restrictions. **Recommendations** Update Elementor Website Builder to a version newer than 3.35.5.

**Name of the Vulnerable Software and Affected Versions** Contact Form by WPForms versions n/a through 1.9.9.3 **Description** A missing authorization flaw exists in Syed Balkhi Contact Form by WPForms wpforms-lite. This issue allows exploitation of incorrectly configured access control security levels. **Recommendations** Versions prior to 1.9.9.4 should be updated.