EUVD-2026-66268
GHSA-mw2j-768f-6vw5
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Employee Panel login is a low-privilege role (PR:L not PR:H); password overwrite constitutes high integrity impact (I:H) enabling full account takeover.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee (provider) owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their account.
AnalysisAI
Broken object-level authorization in the Booking for Appointments and Events Calendar WordPress plugin (versions 9.0 through before 9.8) allows any authenticated employee account to overwrite a different employee's cabinet password, achieving full account takeover of the victim provider. The flaw exists because the plugin's password-update endpoint does not verify that the requesting employee owns the target provider account. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold an active Employee Panel login credential on the target WordPress installation - this is the non-default 'employee' or 'provider' role provisioned by the plugin, not a standard WordPress subscriber or contributor. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 3.1 score of 4.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) understates the integrity impact by rating it L, despite the vulnerability enabling full credential replacement and account takeover of arbitrary employee accounts - a more accurate integrity score would be I:H. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Booking for Appointments and Events Calendar WordPress plugin to version 9.8 or later, which addresses the missing authorization check on the provider cabinet password update endpoint. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated queue-trigger exposure in the Booking for Appointments and Events Calendar WordPress plugin (versions be
Missing authorization in the Booking for Appointments and Events Calendar WordPress plugin (versions before 2.4.9) allow
Broken Object Level Authorization in the Booking for Appointments and Events Calendar WordPress plugin (versions 9.0 thr
Missing authorization enforcement in the Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 allo
Unrestricted mass assignment in the Booking for Appointments and Events Calendar WordPress plugin (before 2.4.4) permits
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today