CVE-2023-2834

CVE-2023-2834 affects the BookIt WordPress plugin up to version 2.3.7, enabling authentication bypass by exploiting insufficient user verification during booking. An unauthenticated attacker can log in as an existing user (e.g., administrator) if they can provide a valid email, as described in Wo...

CVE-2023-50852

CVE-2023-50852 is an authenticated (Administrator+) SQL Injection in Booking Calendar / BookIt WordPress plugin affecting versions up to 2.4.3. The root cause is improper neutralization of SQL elements. A patch exists in 2.4.3; upgrade to a patched version to remediate.