Vulnerability · Published Jun 9, 2023 · Assigned by Wordfence
CVE-2023-2414Online Booking & Scheduling Calendar for WordPress by vcita <= 4.4.6 - Missing Authorization to Settings Update and Arbitrary File Upload
Medium 5.4
In plain English
A medium-severity missing authorization in Online Booking & Scheduling Calendar for WordPress by vcita from vcita. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Official description
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_save_settings_callback function in versions up to, and including, 4.4.6. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to modify the plugins settings, upload arbitrary files, and inject malicious JavaScript (before 4.3.2).
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| vcita | Online Booking & Scheduling Calendar for WordPress by vcita | 0 – through 4.4.6 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3c99aab5-a995-44ae-bc14-09f73e6b22c5?source=cve
- https://plugins.trac.wordpress.org/browser/meeting-scheduler-by-vcita/trunk/vcita-ajax-function.php#L88
- https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita
- https://plugins.trac.wordpress.org/changeset/2933915/meeting-scheduler-by-vcita/trunk/vcita-ajax-function.php?contextall=1&old=2924763&old_path=%2Fmeeting-scheduler-by-vcita%2Ftrunk%2Fvcita-ajax-function.php
- https://plugins.trac.wordpress.org/changeset/3191356/meeting-scheduler-by-vcita/trunk/vcita-ajax-function.php?contextall=1