CVE-2024-6175: CWE-862 Missing Authorization in deetronix Booking Ultra Pro Appointments Booking Calendar Plugin
The Booking Ultra Pro Appointments Booking Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the multiple functions called via AJAX like save_fields_settings, bup_delete_user_avatar, bup_crop_avatar_user_profile_image, and more in all versions up to, and including, 1.1.13. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify and delete. multiple plugin options and data such as payments, pricing, booking information, business hours, calendars, profile information, and email templates.
AI Analysis
Technical Summary
CVE-2024-6175 is a missing authorization vulnerability (CWE-862) in the Booking Ultra Pro Appointments Booking Calendar Plugin for WordPress. The plugin fails to perform proper capability checks on multiple AJAX-invoked functions such as save_fields_settings, bup_delete_user_avatar, and bup_crop_avatar_user_profile_image. This allows authenticated attackers with Subscriber-level privileges or higher to modify or delete various plugin options and data, including payments, pricing, booking information, business hours, calendars, profile information, and email templates. The vulnerability affects all versions up to and including 1.1.13.
Potential Impact
An attacker with at least Subscriber-level access can modify or delete critical booking-related data and plugin settings, potentially disrupting business operations or causing data integrity issues. The impact includes unauthorized changes to payments, pricing, booking schedules, and user profile data. There is no indication of availability impact or known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted individuals only and monitor for suspicious activity related to the affected AJAX functions. Avoid granting Subscriber-level or higher access to untrusted users. Follow vendor communications for updates on patches or official fixes.
CVE-2024-6175: CWE-862 Missing Authorization in deetronix Booking Ultra Pro Appointments Booking Calendar Plugin
Description
The Booking Ultra Pro Appointments Booking Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the multiple functions called via AJAX like save_fields_settings, bup_delete_user_avatar, bup_crop_avatar_user_profile_image, and more in all versions up to, and including, 1.1.13. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify and delete. multiple plugin options and data such as payments, pricing, booking information, business hours, calendars, profile information, and email templates.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-6175 is a missing authorization vulnerability (CWE-862) in the Booking Ultra Pro Appointments Booking Calendar Plugin for WordPress. The plugin fails to perform proper capability checks on multiple AJAX-invoked functions such as save_fields_settings, bup_delete_user_avatar, and bup_crop_avatar_user_profile_image. This allows authenticated attackers with Subscriber-level privileges or higher to modify or delete various plugin options and data, including payments, pricing, booking information, business hours, calendars, profile information, and email templates. The vulnerability affects all versions up to and including 1.1.13.
Potential Impact
An attacker with at least Subscriber-level access can modify or delete critical booking-related data and plugin settings, potentially disrupting business operations or causing data integrity issues. The impact includes unauthorized changes to payments, pricing, booking schedules, and user profile data. There is no indication of availability impact or known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted individuals only and monitor for suspicious activity related to the affected AJAX functions. Avoid granting Subscriber-level or higher access to untrusted users. Follow vendor communications for updates on patches or official fixes.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2024-06-19T23:00:12.873Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 699f6bfcb7ef31ef0b55d5bf
Added to database: 2/25/2026, 9:39:08 PM
Last enriched: 4/9/2026, 8:17:08 PM
Last updated: 4/12/2026, 2:04:53 AM
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.