Online Scheduling And Appointment Booking System
Monthly
SQL injection in the Online Scheduling and Appointment Booking System WordPress plugin before version 27.8 lets unauthenticated attackers extract sensitive database contents, including WordPress user password hashes, through the plugin's public-facing booking request handler. The flaw stems from a user-supplied parameter being neither sanitized nor properly type-cast before use in a SQL query, and is reachable pre-authentication over the network. Publicly available exploit code exists (reported by WPScan), a vendor patch is available, and the EPSS score is low (0.20%) despite the high CVSS of 8.6.
Authenticated users who hold a specifically delegated booking-management capability in the Online Scheduling and Appointment Booking System WordPress plugin (versions 23.2 through 28.3) can chain an unsafe PHP deserialization flaw with a broken access control check on a privileged maintenance routine to inject arbitrary PHP objects, overwrite privileged site options, and read stored integration secrets. The plugin does not restrict that maintenance feature to administrators and does not prevent deserialization of untrusted input, so any account granted this custom capability - which an administrator must explicitly assign, a non-default delegated privilege - can reach the vulnerable path; no end-user interaction is required (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L, score 4.7). Publicly available exploit code exists, but there is no confirmed active exploitation (the issue is not in CISA KEV) and EPSS is only 0.15% (4th percentile), so signals converge on a genuine-but-low real-world priority.
Authenticated staff-level users of the WordPress plugin Online Scheduling and Appointment Booking System (all versions before 28.3) can read, modify, and delete appointment and payment records belonging to other staff members, including the customer personal information attached to those records. The flaw is a missing ownership check on the plugin's staff-role AJAX actions: an attacker only needs a valid staff account and a record identifier belonging to someone else, with no user interaction and remote reachability. Exploitation requires an existing staff-level login and is therefore not reachable by unauthenticated visitors or ordinary subscribers; publicly available exploit code exists via the WPScan disclosure, but there is no confirmed active exploitation (CISA KEV not listed), EPSS is only 0.13% (2nd percentile), and SSVC rates exploitation as none and automatable as no, making this a genuine but low-priority issue.
Unauthenticated visitors to WordPress sites running the Online Scheduling and Appointment Booking System plugin (versions 28.1 through before 28.2) can read other visitors' AI booking-assistant messages and inject new messages into their in-progress conversations, because the plugin's unauthenticated conversation actions never verify that the requester owns the conversation ID being referenced. Rated CVSS 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) under CWE-639, the practical risk hinges on how conversation identifiers are generated: if they are sequential or guessable the flaw is broadly automatable, but if they are opaque tokens exploitation is opportunistic and low-volume, which is why the base score is only moderately elevated. Publicly available exploit code exists and the issue was reported by WPScan, though there is no evidence of confirmed active exploitation (CISA KEV) at time of analysis. There is no availability impact and no path to site takeover described; exposure is limited to the confidentiality and integrity of other visitors' assistant conversations.
SQL injection in the Online Scheduling and Appointment Booking System WordPress plugin before version 27.8 lets unauthenticated attackers extract sensitive database contents, including WordPress user password hashes, through the plugin's public-facing booking request handler. The flaw stems from a user-supplied parameter being neither sanitized nor properly type-cast before use in a SQL query, and is reachable pre-authentication over the network. Publicly available exploit code exists (reported by WPScan), a vendor patch is available, and the EPSS score is low (0.20%) despite the high CVSS of 8.6.
Authenticated users who hold a specifically delegated booking-management capability in the Online Scheduling and Appointment Booking System WordPress plugin (versions 23.2 through 28.3) can chain an unsafe PHP deserialization flaw with a broken access control check on a privileged maintenance routine to inject arbitrary PHP objects, overwrite privileged site options, and read stored integration secrets. The plugin does not restrict that maintenance feature to administrators and does not prevent deserialization of untrusted input, so any account granted this custom capability - which an administrator must explicitly assign, a non-default delegated privilege - can reach the vulnerable path; no end-user interaction is required (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L, score 4.7). Publicly available exploit code exists, but there is no confirmed active exploitation (the issue is not in CISA KEV) and EPSS is only 0.15% (4th percentile), so signals converge on a genuine-but-low real-world priority.
Authenticated staff-level users of the WordPress plugin Online Scheduling and Appointment Booking System (all versions before 28.3) can read, modify, and delete appointment and payment records belonging to other staff members, including the customer personal information attached to those records. The flaw is a missing ownership check on the plugin's staff-role AJAX actions: an attacker only needs a valid staff account and a record identifier belonging to someone else, with no user interaction and remote reachability. Exploitation requires an existing staff-level login and is therefore not reachable by unauthenticated visitors or ordinary subscribers; publicly available exploit code exists via the WPScan disclosure, but there is no confirmed active exploitation (CISA KEV not listed), EPSS is only 0.13% (2nd percentile), and SSVC rates exploitation as none and automatable as no, making this a genuine but low-priority issue.
Unauthenticated visitors to WordPress sites running the Online Scheduling and Appointment Booking System plugin (versions 28.1 through before 28.2) can read other visitors' AI booking-assistant messages and inject new messages into their in-progress conversations, because the plugin's unauthenticated conversation actions never verify that the requester owns the conversation ID being referenced. Rated CVSS 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) under CWE-639, the practical risk hinges on how conversation identifiers are generated: if they are sequential or guessable the flaw is broadly automatable, but if they are opaque tokens exploitation is opportunistic and low-volume, which is why the base score is only moderately elevated. Publicly available exploit code exists and the issue was reported by WPScan, though there is no evidence of confirmed active exploitation (CISA KEV) at time of analysis. There is no availability impact and no path to site takeover described; exposure is limited to the confidentiality and integrity of other visitors' assistant conversations.