Lucene search
PRIOn knowledge basePRION:CVE-2023-2414HistoryJun 09, 2023 - 6:16 a.m.
Design/Logic Flaw
2023-06-0906:16:00
PRIOn knowledge base
www.prio-n.com
3
wordpress
calendar
vulnerability
data modification
capability check
version 4.2.10
authenticated attackers
minimal permissions
subscriber
settings modification
media files
malicious javascript.
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_save_settings_callback function in versions up to, and including, 4.2.10. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to modify the plugins settings, upload media files, and inject malicious JavaScript.
| CPE | Name | Operator | Version |
|---|---|---|---|
| online_booking_\\&_scheduling_calendar | le | 4.2.10 |
Related
cvelist
cvelist
CVE-2023-2414
2023-06-09 05:33:14
cve
cve
CVE-2023-2414
2023-06-09 06:16:07
nvd
nvd
CVE-2023-2414
2023-06-09 06:16:07
wpvulndb
wpvulndb
wordfence
wordfence