CVE-2023-1129 WP FEvents Book <= 0.46 - Subscriber+ Arbitrary Booking Manipulation via IDOR

2023-04-2418:30:52

WPScan

www.cve.org

cve-2023-1129

wp fevents book

arbitrary booking manipulation

idor

authentication bypass

vulnerability

0.001 Low

EPSS

Percentile

23.5%

JSON

The WP FEvents Book WordPress plugin through 0.46 does not ensures that bookings to be updated belong to the user making the request, allowing any authenticated user to book, add notes, or cancel booking on behalf of other users.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "WP FEvents Book",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThanOrEqual": "0.46"
      }
    ],
    "defaultStatus": "affected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

References

wpscan.com/vulnerability/d40479de-fb04-41b8-9fb0-41b9eefbd8af

0.001 Low

EPSS

Percentile

23.5%

JSON

Related for CVELIST:CVE-2023-1129