Webba Booking
Monthly
Missing authorization in the Webba Booking WordPress plugin (webba-booking-lite) through version 6.5.4 lets a logged-in low-privilege user, such as a subscriber, reach a function that omits a proper capability check. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) scores this at 5.4, reflecting low confidentiality and integrity impact with no availability effect, and no user interaction is required. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor reference points to the Patchstack advisory for the 6.5.4 broken access control issue.
Missing authorization (CWE-862) in the Webba Booking WordPress plugin (webba-booking-lite) affects all versions through 6.5.4, allowing a user who already holds a valid low-privilege account on the site to invoke a plugin action that lacks a proper capability check. Successful exploitation is limited to integrity impact - an attacker can alter data or settings the action controls, but cannot read sensitive data or cause a denial of service, and no user interaction is required once credentials exist. The vendor-assigned CVSS 3.1 base score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N); no public exploit code and no confirmed active exploitation were identified at time of analysis, and the priority label is this_month rather than immediate action.
Authenticated users with Subscriber-level access or higher can exploit an insecure direct object reference in Webba Booking (webba-booking-lite) versions 6.5.0 and earlier to read booking records belonging to other users, resulting in limited information disclosure. The vulnerability requires a valid WordPress account (PR:L) and no user interaction, but has a low CVSS score of 4.3 due to its limited confidentiality impact and lack of integrity or availability effects. No public exploit code has been identified, and the issue is considered a low-priority, low-real-risk vulnerability per independent assessment, though sites with open user registration face greater exposure.
Unauthenticated remote attackers can bypass access controls in the Webba Booking WordPress plugin (all versions through 6.4.13) due to missing server-side authorization checks on one or more booking-related endpoints, enabling unauthorized integrity-affecting actions such as creating, modifying, or canceling bookings. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero-friction exploitation requiring no credentials or user interaction against any internet-facing WordPress site running the affected plugin. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog.
The Appointment & Event Booking Calendar Plugin - Webba Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_appearance(). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
Cross-Site Request Forgery (CSRF) vulnerability in WebbaPlugins Appointment & Event Booking Calendar Plugin - Webba Booking.5.33. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing authorization in the Webba Booking WordPress plugin (webba-booking-lite) through version 6.5.4 lets a logged-in low-privilege user, such as a subscriber, reach a function that omits a proper capability check. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) scores this at 5.4, reflecting low confidentiality and integrity impact with no availability effect, and no user interaction is required. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor reference points to the Patchstack advisory for the 6.5.4 broken access control issue.
Missing authorization (CWE-862) in the Webba Booking WordPress plugin (webba-booking-lite) affects all versions through 6.5.4, allowing a user who already holds a valid low-privilege account on the site to invoke a plugin action that lacks a proper capability check. Successful exploitation is limited to integrity impact - an attacker can alter data or settings the action controls, but cannot read sensitive data or cause a denial of service, and no user interaction is required once credentials exist. The vendor-assigned CVSS 3.1 base score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N); no public exploit code and no confirmed active exploitation were identified at time of analysis, and the priority label is this_month rather than immediate action.
Authenticated users with Subscriber-level access or higher can exploit an insecure direct object reference in Webba Booking (webba-booking-lite) versions 6.5.0 and earlier to read booking records belonging to other users, resulting in limited information disclosure. The vulnerability requires a valid WordPress account (PR:L) and no user interaction, but has a low CVSS score of 4.3 due to its limited confidentiality impact and lack of integrity or availability effects. No public exploit code has been identified, and the issue is considered a low-priority, low-real-risk vulnerability per independent assessment, though sites with open user registration face greater exposure.
Unauthenticated remote attackers can bypass access controls in the Webba Booking WordPress plugin (all versions through 6.4.13) due to missing server-side authorization checks on one or more booking-related endpoints, enabling unauthorized integrity-affecting actions such as creating, modifying, or canceling bookings. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero-friction exploitation requiring no credentials or user interaction against any internet-facing WordPress site running the affected plugin. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog.
The Appointment & Event Booking Calendar Plugin - Webba Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_appearance(). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
Cross-Site Request Forgery (CSRF) vulnerability in WebbaPlugins Appointment & Event Booking Calendar Plugin - Webba Booking.5.33. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.