PT-2025-1798 · WordPress · Appointment Booking Calendar Plugin

Published 2025-01-13 · Updated 2025-05-08 · CVE-2024-12274

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Appointment Booking Calendar Plugin and Scheduling Plugin versions prior to 1.1.23

Description The export settings functionality in the Appointment Booking Calendar Plugin and Scheduling Plugin exports data to a public folder with an easily guessable file name, allowing unauthenticated attackers to access the exported files if they exist. This issue can be exploited by accessing the easily guessable file name in the public folder where the exported files are stored.

Recommendations For versions prior to 1.1.23, update to version 1.1.23 or later to resolve the issue. As a temporary workaround, consider restricting access to the public folder where the exported files are stored to minimize the risk of exploitation. Avoid using the export settings functionality until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2024-12274

Affected Products

Appointment Booking Calendar Plugin

References · 10

• 🔥 https://wpscan.com/vulnerability/e3176c9a-63f3-4a28-a8a7-8abb2b4100ef · Exploit
• https://osv.dev/vulnerability/CVE-2024-12274 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-12274 · Security Note
• https://t.me/cvenotify/107208 · Telegram Post
• https://t.me/cvedetector/15121 · Telegram Post
• https://t.me/cvenotify/121453 · Telegram Post
• https://twitter.com/cracbot/status/1879770624140468469 · Twitter Post
• https://twitter.com/CVETracker/status/1878894975234007331 · Twitter Post
• https://t.me/cvenotify/107182 · Telegram Post
• https://twitter.com/CVEnew/status/1878688543884591154 · Twitter Post