PT-2024-31208 · WordPress · Salon Booking System

Joan Clarke + 1 · Published 2024-06-08 · Updated 2024-10-31 · CVE-2024-4468

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Salon booking system plugin for WordPress versions up to, and including, 9.9

Description The issue allows unauthorized access and modification of data due to a missing capability check on several functions hooked into admin init. This makes it possible for authenticated attackers with subscriber access or higher to modify plugin settings and view discount codes intended for other users.

Recommendations For versions up to, and including, 9.9, upgrade to a version higher than 9.9 to resolve the issue. As a temporary workaround, consider restricting access to the plugin's settings and discount codes to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

CWE-280

Related Identifiers

CVE-2024-4468

Affected Products

Salon Booking System

References · 17

• https://nvd.nist.gov/vuln/detail/CVE-2024-4468 · Security Note
• https://plugins.trac.wordpress.org/changeset/3098413/salon-booking-system/trunk/src/SLN/Admin/Tools.php · Patch
• https://plugins.trac.wordpress.org/changeset/3098413/salon-booking-system/trunk/src/SLB_Discount/Admin/ExportDiscountsCsv.php · Patch
• https://osv.dev/vulnerability/CVE-2024-4468 · Vendor Advisory
• https://t.me/cvenotify/82528 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1799391220231270425 · Twitter Post
• https://twitter.com/CVEnew/status/1799348431116202311 · Twitter Post
• https://t.me/cvenotify/100213 · Telegram Post
• https://plugins.trac.wordpress.org/browser/salon-booking-system/trunk/src/SLB_Discount/Admin/ExportDiscountsCsv.php#L10 · Note
• https://twitter.com/linuxpatch/status/1799367153549815827 · Twitter Post
• https://plugins.trac.wordpress.org/browser/salon-booking-system/trunk/src/SLN/Admin/Tools.php#L231 · Note
• https://plugins.trac.wordpress.org/browser/salon-booking-system/trunk/src/SLN/Admin/Tools.php#L16 · Note
• https://plugins.trac.wordpress.org/browser/salon-booking-system/trunk/src/SLN/Admin/Tools.php#L12 · Note
• https://plugins.trac.wordpress.org/browser/salon-booking-system/trunk/src/SLB_Discount/Admin/ExportDiscountsCsv.php#L16 · Note
• https://t.me/cvenotify/82351 · Telegram Post