PT-2023-18812 · Vcita · Online Booking & Scheduling Calendar For Wordpress

Jonas Höbenreich · Published 2023-06-03 · Updated 2025-06-10 · CVE-2023-2299

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress versions up to, and including, 4.2.10

Description The issue allows unauthorized modification of data via the "/wp-json/vcita-wordpress/v1/actions/auth" REST-API endpoint due to a missing capability check on the processAction function. This enables unauthenticated attackers to modify the plugin's settings.

Recommendations For versions up to, and including, 4.2.10, update to a version that includes a fix for the missing capability check on the processAction function. As a temporary workaround, consider restricting access to the "/wp-json/vcita-wordpress/v1/actions/auth" endpoint until a patch is available.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-2299

Affected Products

Online Booking & Scheduling Calendar For Wordpress

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2023-2299 · Security Note
• https://plugins.trac.wordpress.org/browser/meeting-scheduler-by-vcita/trunk/vcita-api-functions.php · Patch
• https://osv.dev/vulnerability/CVE-2023-2299 · Vendor Advisory
• https://t.me/cvenotify/52054 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3104980/meeting-scheduler-by-vcita/trunk/vcita-api-functions.php · Note
• https://t.me/cvenotify/51678 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/4855627a-de56-49ee-b0b0-01b9735d8557?source=cve · Note
• https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita · Note
• https://t.me/cvenotify/125238 · Telegram Post
• https://t.me/cvenotify/51736 · Telegram Post