Log in Start free

Vulnerability · Published Sep 5, 2024 · Assigned by Wordfence

CVE-2024-6332Booking for Appointments and Events Calendar – Amelia Premium <= 7.7 and Lite <= 1.2.4 - Missing Authorization to Sensitive Information Exposure

Medium 6.5

In plain English

A medium-severity missing authorization in Booking for Appointments and Events Calendar – Amelia Pro from Amelia. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 71.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The Booking for Appointments and Events Calendar – Amelia Premium and Lite plugins for WordPress are vulnerable to unauthorized access of data due to a missing capability check on the 'ameliaButtonCommand' function in all versions up to, and including, Premium 7.7 and Lite 1.2.4. This makes it possible for unauthenticated attackers to access employee calendar details, including Google Calendar OAuth tokens in the premium version.

Affected products (as reported)

VendorProductVersions
ameliabooking Booking for Appointments and Events Calendar – Amelia 0 – through 1.2.4
Amelia Booking for Appointments and Events Calendar – Amelia Pro 0 – through 7.7

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References