CVE-2022-4340

BookingPress < 1.0.31 - Unauthenticated IDOR in appointment_id

Medium · published January 2, 2023

CVSS v3.1
5.3
EPSS
1%
Percentile
51.7
In the wild
Unconfirmed
What it is

The BookingPress WordPress plugin before 1.0.31 suffers from an Insecure Direct Object Reference (IDOR) vulnerability in it's thank you page, allowing any visitor to display information about any booking, including full name, date, time and service booked, by manipulating the appointment_id query parameter.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00676 · 51.7th percentile
Published
2023-01-02T21:49Z
EPSS history
Timeline
  • 02 JAN 21:49Z
    BookingPress < 1.0.31 - Unauthenticated IDOR in appointment_id
    cvelistv5