High · published November 12, 2025
⚡ A missing capability check is all it takes for an attacker to connect their Stripe account to your site! This vulnerability in the Booking Calendar | Appointment Booking | Bookit plugin for WordPress is a sneaky one that could lead to unauthorized data modification. 🔥 Think of this as a busy restaurant's order system that forgets to verify which waiter is putting in the food orders. Any waiter could simply slip in a fake order and get paid without anyone noticing! If exploited, an attacker could manipulate your payments, diverting funds meant for your business straight into their own Stripe account. This could lead to significant financial loss, damage to your reputation, and a massive headache trying to sort out the aftermath!
Think of this as a busy restaurant's order system that forgets to verify which waiter is putting in the food orders. Any waiter could simply slip in a fake order and get paid without anyone noticing! This vulnerability arises from a missing capability check on the '/wp-json/bookit/v1/commerce/stripe/return' REST API endpoint, allowing unauthenticated users to interact with the payment system without proper authorization.
If exploited, an attacker could manipulate your payments, diverting funds meant for your business straight into their own Stripe account. This could lead to significant financial loss, damage to your reputation, and a massive headache trying to sort out the aftermath! Immediately update the Bookit plugin to version 2.5.1 or later to patch this vulnerability. Additionally, review your existing API permissions and implement stricter checks to prevent unauthorized access. You've got this! Fixing this vulnerability will bolster your security and keep your business safe! 🛡️