4 matches found
CVE-2024-13821
The WP Booking Calendar plugin for WordPress is vulnerable to Unauthenticated Post-Confirmation Booking Manipulation in all versions up to, and including, 10.10. This is due to the plugin not properly requiring re-verification after a booking has been made and a change is being attempted. This...
CVE-2024-13821
creationtimestamp| type| source ---|---|--- 2025-02-12 07:40:26+00:00| seen| https://infosec.exchange/users/cve/statuses/113989781136121545 2025-02-12 08:15:34+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhxq7tskc22z 2025-02-12 09:08:24+00:00|...
CVE-2024-13821 WP Booking Calendar <= 10.10 - Unauthenticated Post-Confirmation Booking Manipulation
The WP Booking Calendar plugin for WordPress is vulnerable to Unauthenticated Post-Confirmation Booking Manipulation in all versions up to, and including, 10.10. This is due to the plugin not properly requiring re-verification after a booking has been made and a change is being attempted. This...
CVE-2024-13821
CVE-2024-13821 concerns the WordPress plugin WP Booking Calendar (<= 10.10). The defect allows unauthenticated actors to manipulate their confirmed bookings after approval because re-verification after a booking change is not enforced. The CVSS 3.1 base score is 5.3 (Network, Low complexity, N...