Booking For Appointments And Events Calendar
Monthly
Missing authorization in the Booking for Appointments and Events Calendar WordPress plugin (versions before 2.4.9) allows unauthenticated remote attackers to trigger the post-booking action chain - including email notifications and third-party integration callbacks - for any booking by guessing or enumerating its numeric identifier. The plugin fails to validate either session authentication or a nonce/request token before executing post-booking hooks, meaning an attacker can impersonate the completion of any booking without ever making a real reservation. A publicly available proof-of-concept exploit exists per WPScan, though no KEV listing confirms active mass exploitation.
Missing authorization enforcement in the Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 allows authenticated customers to escalate their own booking status without approval and tamper with other customers' statuses on shared appointments. The flaw (CWE-863) stems from the absence of a WordPress capability check before processing status-change requests, meaning any user with a booking can invoke the endpoint and set arbitrary statuses. No public exploitation has been confirmed by CISA KEV, but a publicly available proof-of-concept exists per WPScan.
Unauthenticated queue-trigger exposure in the Booking for Appointments and Events Calendar WordPress plugin (versions before 2.4.7) permits any remote visitor to force the dispatch of the plugin's pending notification queue and integration callbacks. Because the queue-processing endpoint performs no authentication check (CWE-287), an attacker needs no credentials or session to invoke it. A publicly available proof-of-concept exists per the WPScan report, though EPSS at 0.23% indicates exploitation has not yet reached widespread automated activity, and the vulnerability is not listed in CISA KEV.
Broken object-level authorization in the Booking for Appointments and Events Calendar WordPress plugin (versions 9.0 through before 9.8) allows any authenticated employee account to overwrite a different employee's cabinet password, achieving full account takeover of the victim provider. The flaw exists because the plugin's password-update endpoint does not verify that the requesting employee owns the target provider account. A publicly available proof-of-concept exists; no active exploitation has been confirmed by CISA KEV at time of analysis.
Broken Object Level Authorization in the Booking for Appointments and Events Calendar WordPress plugin (versions 9.0 through 9.6) permits any authenticated employee (provider) to read and modify the stored personal data of arbitrary customers by incrementing sequential record identifiers in the Employee Panel. The plugin fails to verify that the requesting employee has a legitimate relationship with the customer being accessed, enabling horizontal privilege escalation across all customer records. A publicly available exploit exists per WPScan, though EPSS of 0.13% (3rd percentile) suggests exploitation has remained uncommon; no CISA KEV listing has been confirmed at time of analysis.
Unrestricted mass assignment in the Booking for Appointments and Events Calendar WordPress plugin (before 2.4.4) permits any user holding the Amelia Manager role to overwrite arbitrary database columns on stored user records by injecting unsanitized fields into customer import requests. This can enable data tampering or privilege manipulation within the booking system's user table. No public exploitation is confirmed via CISA KEV, but a POC is publicly available through WPScan; EPSS remains at 0.13% (3rd percentile), consistent with limited real-world exploitation probability given the high-privilege prerequisite.
Missing authorization in the Booking for Appointments and Events Calendar WordPress plugin (versions before 2.4.9) allows unauthenticated remote attackers to trigger the post-booking action chain - including email notifications and third-party integration callbacks - for any booking by guessing or enumerating its numeric identifier. The plugin fails to validate either session authentication or a nonce/request token before executing post-booking hooks, meaning an attacker can impersonate the completion of any booking without ever making a real reservation. A publicly available proof-of-concept exploit exists per WPScan, though no KEV listing confirms active mass exploitation.
Missing authorization enforcement in the Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 allows authenticated customers to escalate their own booking status without approval and tamper with other customers' statuses on shared appointments. The flaw (CWE-863) stems from the absence of a WordPress capability check before processing status-change requests, meaning any user with a booking can invoke the endpoint and set arbitrary statuses. No public exploitation has been confirmed by CISA KEV, but a publicly available proof-of-concept exists per WPScan.
Unauthenticated queue-trigger exposure in the Booking for Appointments and Events Calendar WordPress plugin (versions before 2.4.7) permits any remote visitor to force the dispatch of the plugin's pending notification queue and integration callbacks. Because the queue-processing endpoint performs no authentication check (CWE-287), an attacker needs no credentials or session to invoke it. A publicly available proof-of-concept exists per the WPScan report, though EPSS at 0.23% indicates exploitation has not yet reached widespread automated activity, and the vulnerability is not listed in CISA KEV.
Broken object-level authorization in the Booking for Appointments and Events Calendar WordPress plugin (versions 9.0 through before 9.8) allows any authenticated employee account to overwrite a different employee's cabinet password, achieving full account takeover of the victim provider. The flaw exists because the plugin's password-update endpoint does not verify that the requesting employee owns the target provider account. A publicly available proof-of-concept exists; no active exploitation has been confirmed by CISA KEV at time of analysis.
Broken Object Level Authorization in the Booking for Appointments and Events Calendar WordPress plugin (versions 9.0 through 9.6) permits any authenticated employee (provider) to read and modify the stored personal data of arbitrary customers by incrementing sequential record identifiers in the Employee Panel. The plugin fails to verify that the requesting employee has a legitimate relationship with the customer being accessed, enabling horizontal privilege escalation across all customer records. A publicly available exploit exists per WPScan, though EPSS of 0.13% (3rd percentile) suggests exploitation has remained uncommon; no CISA KEV listing has been confirmed at time of analysis.
Unrestricted mass assignment in the Booking for Appointments and Events Calendar WordPress plugin (before 2.4.4) permits any user holding the Amelia Manager role to overwrite arbitrary database columns on stored user records by injecting unsanitized fields into customer import requests. This can enable data tampering or privilege manipulation within the booking system's user table. No public exploitation is confirmed via CISA KEV, but a POC is publicly available through WPScan; EPSS remains at 0.13% (3rd percentile), consistent with limited real-world exploitation probability given the high-privilege prerequisite.