Lucene search
HistoryApr 24, 2023 - 7:15 p.m.
CVE-2023-1129
wp fevents book
wordpress plugin
authenticated users
user bookings
add notes
cancel booking
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
0.001 Low
EPSS
Percentile
23.5%
The WP FEvents Book WordPress plugin through 0.46 does not ensures that bookings to be updated belong to the user making the request, allowing any authenticated user to book, add notes, or cancel booking on behalf of other users.
Affected configurations
Node
wp_fevents_book_projectwp_fevents_bookRange≤0.46wordpress
Related
cve
cve
CVE-2023-1129
2023-04-24 19:15:09
wpexploit
wpexploit
wpvulndb
wpvulndb
prion
prion
Design/Logic Flaw
2023-04-24 19:15:00
cvelist
cvelist
wordfence
wordfence
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
0.001 Low
EPSS
Percentile
23.5%
Related for NVD:CVE-2023-1129