PT-2023-30258 · WordPress · Wordpress Online Booking/Scheduling Plugin

Pablo Sanchez · Published 2023-10-16 · Updated 2023-10-20 · CVE-2023-4691

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The WordPress Online Booking and Scheduling Plugin versions prior to 22.4

Description The issue arises from the plugin's failure to properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection. This can be exploited by high privilege users such as admin.

Recommendations For versions prior to 22.4, update to version 22.4 or later to resolve the issue. As a temporary workaround, consider restricting access to high privilege users until the update is applied.

Exploit

Fix

Related Identifiers

CVE-2023-4691

Affected Products

Wordpress Online Booking/Scheduling Plugin

References · 4

• 🔥 https://wpscan.com/vulnerability/5085ec75-0795-4004-955d-e71b3d2c26c6 · Exploit
• https://osv.dev/vulnerability/CVE-2023-4691 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4691 · Security Note
• https://twitter.com/CVEnew/status/1714006538371674120 · Twitter Post