Threats tagged 'ghsa-mhjw-fw4w-ff4c'

The Booking for Appointments and Events Calendar WordPress plugin versions before 2.4.6 contains an access control vulnerability. It fails to verify that an authenticated employee (provider) is assigned to the appointment being accessed. This flaw allows any authenticated employee to read any appointment by its identifier, potentially exposing the booked customer's personal data. The vulnerability has a low severity rating with a CVSS score of 3.7. No known exploits in the wild have been reported. No explicit patch information is provided in the source data.