PT-2024-12034 · Wpdevart · Wpdevart Booking Calendar

Yuyudhn · Published 2024-12-09 · Updated 2024-12-09 · CVE-2023-24407

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WpDevArt Booking calendar, Appointment Booking System versions 3.2.3 and earlier

Description The issue affects the WpDevArt Booking calendar, Appointment Booking System due to a Missing Authorization vulnerability. This vulnerability allows exploitation of incorrectly configured access control security levels.

Recommendations For versions 3.2.3 and earlier, update to a version that contains a fix for this issue, as no specific workaround is provided for these versions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-24407

Affected Products

Wpdevart Booking Calendar

References · 5

• https://osv.dev/vulnerability/CVE-2023-24407 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-24407 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/booking-calendar/vulnerability/wordpress-booking-calendar-appointment-booking-system-plugin-3-2-3-broken-access-control?_s_id=cve · Note
• https://patchstack.com/database/wordpress/plugin/booking-calendar/vulnerability/wordpress-booking-calendar-appointment-booking-system-plugin-3-2-3-broken-access-control?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1866084828233306254 · Twitter Post