Bookingpress
CVE-2024-6660
HIGH
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The BookingPress - Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the bookingpress_import_data_continue_process_func function in all versions up to, and including, 1.1.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site and upload arbitrary files. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
AnalysisAI
The BookingPress - Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Technical ContextAI
This vulnerability is classified under CWE-280. The BookingPress - Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the bookingpress_import_data_continue_process_func function in all versions up to, and including, 1.1.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site and upload arbitrary files. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. Affected products include: Reputeinfosystems Bookingpress.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Bookingpress
View allThe BookingPress WordPress plugin before 1.0.11 fails to properly sanitize user supplied POST data before it is used in
Authenticated arbitrary file upload in the BookingPress WordPress plugin (versions through 1.0.87) enables remote code e
The BookingPress - Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin for WordPress is vulnerable t
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Repute Infosystems
Improper Authentication vulnerability in Repute Infosystems BookingPress allows Accessing Functionality Not Properly Con
The BookingPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the
The Appointment Booking Calendar Plugin and Scheduling Plugin - BookingPress plugin for WordPress is vulnerable to SQL I
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Repute Infosystems BookingPress - Appointmen
Missing Authorization vulnerability in Repute Infosystems BookingPress.0.82. Rated medium severity (CVSS 5.3), this vuln
Authorization Bypass Through User-Controlled Key vulnerability in Repute Infosystems BookingPress.0.81. Rated medium sev
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today