Description
WordPress Plugin Appointment Booking Calendar and Online Scheduling-BookingPress is prone to a insecure direct object reference (IDOR) vulnerability. Exploiting this issue may allow an attacker to view information about any booking, including full name, date, time and service booked. WordPress Plugin Appointment Booking Calendar and Online Scheduling-BookingPress version 1.0.30 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 1.0.31 or latest
References
Related Vulnerabilities
WordPress Plugin Find My Blocks Information Disclosure (3.3.2)
WordPress Plugin Qtranslate Slug Unspecified Vulnerability (1.1.16)
PHP Inadequate Encryption Strength Vulnerability (CVE-2020-7069)
phpMyAdmin Other Vulnerability (CVE-2004-2630)
WordPress Plugin Pinpoint Booking System-#1 WordPress Booking SQL Injection (1.2)