« Volver al listado

CVE-2024-7350

Estado: AplazadaCrítica (9.8)—

The Appointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress plugin for WordPress is vulnerable to authentication bypass in versions 1.1.6 to 1.1.7. This is due to the plugin not properly verifying a user's identity prior to logging them in when completing a booking. This makes it possible for unauthenticated attackers to log in as registered users, including administrators, if they have access to that user's email. This is only exploitable when the 'Auto login user after successful booking' setting is enabled.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Reputeinfosystems — BookingpressAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-7350",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-7350",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-08T13:17:52.373438Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@wordfence.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@wordfence.com",
      "affectedData": [
        {
          "vendor": "reputeinfosystems",
          "product": "Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress",
          "versions": [
            {
              "status": "affected",
              "version": "1.1.6",
              "versionType": "semver",
              "lessThanOrEqual": "1.1.7"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:reputeinfosystems:appointment_booking_calendar_plugin_and_scheduling_plugin_bookingpress:*:*:*:*:*:*:*:*"
          ],
          "vendor": "reputeinfosystems",
          "product": "appointment_booking_calendar_plugin_and_scheduling_plugin_bookingpress",
          "versions": [
            {
              "status": "affected",
              "version": "1.1.6",
              "versionType": "semver",
              "lessThanOrEqual": "1.1.7"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-08-08T03:15:34.800",
  "references": [
    {
      "url": "https://plugins.trac.wordpress.org/browser/bookingpress-appointment-booking/trunk/core/classes/class.bookingpress_customers.php#L339",
      "source": "security@wordfence.com"
    },
    {
      "url": "https://plugins.trac.wordpress.org/changeset/3130266/bookingpress-appointment-booking/trunk/core/classes/class.bookingpress_customers.php",
      "source": "security@wordfence.com"
    },
    {
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4c367565-75f7-4dd7-a2f1-111df581bd7a?source=cve",
      "source": "security@wordfence.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@wordfence.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-288"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Appointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress plugin for WordPress is vulnerable to authentication bypass in versions 1.1.6 to 1.1.7. This is due to the plugin not properly verifying a user's identity prior to logging them in when completing a booking. This makes it possible for unauthenticated attackers to log in as registered users, including administrators, if they have access to that user's email.  This is only exploitable when the 'Auto login user after successful booking' setting is enabled."
    },
    {
      "lang": "es",
      "value": "El complemento Appointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress  para WordPress es vulnerable a la omisión de autenticación en las versiones 1.1.6 a 1.1.7. Esto se debe a que el complemento no verifica adecuadamente la identidad del usuario antes de iniciar sesión al completar una reserva. Esto hace posible que atacantes no autenticados inicien sesión como usuarios registrados, incluidos administradores, si tienen acceso al correo electrónico de ese usuario. Esto solo se puede explotar cuando la configuración \"Inicio de sesión automático de usuario después de una reserva exitosa\" está habilitada."
    }
  ],
  "lastModified": "2026-06-17T08:19:55.193",
  "sourceIdentifier": "security@wordfence.com"
}