Threats tagged 'ghsa-v33c-8q9v-p4jw'

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress versions up to 2.4.12 is vulnerable to sensitive information exposure via the 'page' parameter. This vulnerability allows unauthenticated attackers to access personally identifiable information of staff members, including full name, email, phone number, gender, and timezone, as well as internal notes authored by administrators for published events. The sensitive data is exposed because the raw providers array is included in the JSON response without proper filtering.