CVE-2022-4340

🗓️ 02 Jan 2023 21:49:16Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 51 Views🌐 WEB

The BookingPress WordPress plugin before 1.0.31 has an IDOR vulnerability in the thank you page, allowing unauthorized access to booking information

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2022-4340	3 Jan 202300:29	–	circl
CNNVD	WordPress plugin BookingPress 安全漏洞	2 Jan 202300:00	–	cnnvd
Cvelist	CVE-2022-4340 BookingPress < 1.0.31 - Unauthenticated IDOR in appointment_id	2 Jan 202321:49	–	cvelist
EUVD	EUVD-2022-51693	3 Oct 202520:07	–	euvd
NVD	CVE-2022-4340	2 Jan 202322:15	–	nvd
Prion	Information disclosure	2 Jan 202322:15	–	prion
Positive Technologies	PT-2023-14197 · WordPress · Bookingpress	2 Jan 202300:00	–	ptsecurity
RedhatCVE	CVE-2022-4340	22 May 202523:55	–	redhatcve
Vulnrichment	CVE-2022-4340 BookingPress < 1.0.31 - Unauthenticated IDOR in appointment_id	2 Jan 202321:49	–	vulnrichment
wpexploit	BookingPress < 1.0.31 - Unauthenticated IDOR in appointment_id	7 Dec 202200:00	–	wpexploit

NVD

Vulners

Node

reputeinfosystems bookingpressRange<1.0.31wordpress

[
  {
    "vendor": "Unknown",
    "product": "BookingPress",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "1.0.31"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/8a7bd9f6-2789-474b-a237-01c643fdfba7

Parameter	Position	Path	Description	CWE
appointment_id	query param	/thank-you/?appointment_id=	Insecure Direct Object Reference (IDOR) on thank-you page allowing disclosure of booking details by modifying appointment_id	CWE-284

10 Apr 2025 19:15Current

5.1Medium risk

Vulners AI Score5.1

CVSS 3.15.3

EPSS0.00326

SSVC