CVE-2023-2414

2023-06-0906:16:07

[email protected]

web.nvd.nist.gov

cve-2023-2414

wordpress

vcita plugin

data modification

unauthorized access

security vulnerability

nvd

capability check

settings modification

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.5%

JSON

The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_save_settings_callback function in versions up to, and including, 4.2.10. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to modify the plugins settings, upload media files, and inject malicious JavaScript.

Affected configurations

Vulners

NVD

Node

vcitaonline_booking_\&_scheduling_calendar_for_wordpress_by_vcitaRange≤4.2.10

VendorProductVersionCPE
vcitaonline_booking_\&_scheduling_calendar_for_wordpress_by_vcita*cpe:2.3:a:vcita:online_booking_\&_scheduling_calendar_for_wordpress_by_vcita:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
vcita	online_booking_\&_scheduling_calendar_for_wordpress_by_vcita	*	cpe:2.3:a:vcita:online_booking_\&_scheduling_calendar_for_wordpress_by_vcita::::::::

CNA Affected

[
  {
    "vendor": "vcita",
    "product": "Online Booking & Scheduling Calendar for WordPress by vcita",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "4.2.10",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]