Vulnerability · Published Apr 24, 2023 · Assigned by WPScan
CVE-2023-1129WP FEvents Book <= 0.46 - Subscriber+ Arbitrary Booking Manipulation via IDOR
Medium 6.5
In plain English
A medium-severity security flaw in WP FEvents Book from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.6%top 53.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The WP FEvents Book WordPress plugin through 0.46 does not ensures that bookings to be updated belong to the user making the request, allowing any authenticated user to book, add notes, or cancel booking on behalf of other users.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | WP FEvents Book | 0 – through 0.46 |
References
- https://wpscan.com/vulnerability/d40479de-fb04-41b8-9fb0-41b9eefbd8af exploit, vdb-entry, technical-description