Skip to main content

Booking Calendar CVE-2023-24407

MEDIUM
Missing Authorization (CWE-862)
2024-12-09 audit@patchstack.com
WordPress Authentication Bypass Booking Calendar Wordpress Plugin Wpdevart
5.0
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.0 MEDIUM
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

1
CVE Published
Dec 09, 2024 - 13:15 cve.org
MEDIUM 5.0

DescriptionCVE.org

Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking calendar, Appointment Booking System: from n/a through <= 3.2.3.

AnalysisAI

Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.2.3. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Missing Authorization (CWE-862), which allows attackers to access resources or perform actions without proper authorization checks. Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.2.3. Affected products include: Wpdevart Booking Calendar.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement role-based access control, validate authorization on every request server-side, apply principle of least privilege.

More in Booking Calendar

View all
CVE-2024-1207 CRITICAL
9.8 Feb 08

The WP Booking Calendar plugin for WordPress is vulnerable to SQL Injection via the 'calendar_request_params[dates_ddmmy
CVE-2022-3982 CRITICAL POC
9.8 Dec 12

The Booking calendar, Appointment Booking System WordPress plugin before 3.2.2 does not validate uploaded files, which c
CVE-2022-1463 HIGH POC
8.8 May 10

The Booking Calendar plugin for WordPress is vulnerable to PHP Object Injection via the [bookingflextimeline] shortcode

CVE-2018-5673 HIGH POC
8.8 Jan 13

An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. Rated high severity (CVSS 8.8), this vulnera
CVE-2023-4620 MEDIUM POC
6.1 Oct 16

The Booking Calendar WordPress plugin before 9.7.3.1 does not sanitize and escape some of its booking from data, allowin
CVE-2018-5672 MEDIUM POC
4.8 Jan 13

An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. Rated medium severity (CVSS 4.8), this vulne
CVE-2018-5671 MEDIUM POC
4.8 Jan 13

An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. Rated medium severity (CVSS 4.8), this vulne
CVE-2018-5670 MEDIUM POC
4.8 Jan 13

An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. Rated medium severity (CVSS 4.8), this vulne
CVE-2026-32358 HIGH
7.6 Mar 13

Booking Calendar versions 10.14.15 and earlier contain a blind SQL injection vulnerability in database query handling th
CVE-2018-10363 HIGH
7.5 Jun 13

An issue was discovered in the WpDevArt "Booking calendar, Appointment Booking System" plugin 2.2.2 for WordPress. Rated
CVE-2026-59558 HIGH
7.1 Jul 27

Cross-site scripting in the Booking Calendar WordPress plugin through version 11.4.2 allows unauthenticated attackers to
CVE-2022-47428 MEDIUM
6.7 Nov 06

A vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar.2.7. Rated medium severity (CV

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2025-20362 HIGH POC
8.6
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2020-36719 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2023-24407 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy