CVE-2024-0856

2024-03-2005:15:45

[email protected]

web.nvd.nist.gov

cve-2024-0856

appointment booking

calendar

wordpress

plugin

csrf

vulnerability

nvd

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

The Appointment Booking Calendar WordPress plugin before 1.3.83 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding a booking to the calendar without paying.

Affected configurations

Vulners

Node

codepeopleappointment_booking_calendarRange<1.3.83

VendorProductVersionCPE
codepeopleappointment_booking_calendar*cpe:2.3:a:codepeople:appointment_booking_calendar:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
codepeople	appointment_booking_calendar	*	cpe:2.3:a:codepeople:appointment_booking_calendar::::::::

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Appointment Booking Calendar",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "1.3.83"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

wpscan.com/vulnerability/eb383600-0cff-4f24-8127-1fb118f0565a/