PT-2022-16234 · WordPress · Simply Schedule Appointments

Raad Haddad · Published 2022-08-29 · Updated 2022-09-01 · CVE-2022-2373

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Simply Schedule Appointments WordPress plugin versions prior to 1.5.7.7

Description The issue is related to missing authorization in a REST endpoint, allowing unauthenticated users to retrieve WordPress users' details, such as name and email address.

Recommendations For versions prior to 1.5.7.7, update to version 1.5.7.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the REST endpoint until a patch is applied.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-2373

Affected Products

Simply Schedule Appointments

References · 5

• 🔥 https://wpscan.com/vulnerability/6aa9aa0d-b447-4584-a07e-b8a0d1b83a31 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-2373 · Security Note
• https://osv.dev/vulnerability/CVE-2022-2373 · Vendor Advisory
• https://t.me/cibsecurity/49002 · Telegram Post
• https://t.me/cvenotify/35355 · Telegram Post