Threat database

The WP Booking System – Booking Calendar WordPress plugin up to version 2.1.0.3 suffers from an authorization bypass vulnerability. This flaw allows unauthenticated attackers or any subscriber-level user to access stored notification email bodies of bookings by iterating booking and email log IDs. Sensitive customer information such as names, email addresses, phone numbers, messages, and booking dates intended only for administrators can be exposed. The vulnerability arises because the plugin does not properly verify user authorization when performing certain actions.

The WP Booking System – Booking Calendar WordPress plugin up to version 2.1.0.3 contains an authorization bypass vulnerability. Authenticated users with subscriber-level access or higher can exploit this flaw to grant themselves and others edit access to all booking forms by manipulating the user_permission meta. Exploitation requires prior delegated edit rights on at least one booking form to obtain a valid nonce. This vulnerability allows unauthorized privilege escalation within the plugin's access control.

The WP Booking System – Booking Calendar WordPress plugin versions up to and including 2.1.0.3 contain a missing authorization vulnerability. Authenticated users with subscriber-level access or higher can exploit the 'id' parameter to access private booking descriptions and booking IDs from any calendar on the site. This vulnerability leads to sensitive information exposure without impacting data integrity or availability.

The WP Booking System – Booking Calendar WordPress plugin contains an SQL Injection vulnerability in the 'data[orderby]' parameter in all versions up to and including 2.1.0.1. This flaw allows authenticated administrators to inject additional SQL queries due to insufficient input escaping and query preparation. Exploitation requires the calendar to have more than 200 bookings, as the vulnerable code path is triggered only under this condition. The vulnerability can lead to unauthorized disclosure of sensitive database information. The CVSS score is 4.9, indicating a medium severity risk.

The WP Booking System – Booking Calendar WordPress plugin is vulnerable to a time-based SQL Injection via the 'current_month' parameter in all versions up to and including 2.1.0.1. This vulnerability allows authenticated users with subscriber-level access or higher to inject additional SQL queries due to insufficient input escaping and lack of proper query preparation. The issue is a regression caused by the removal of a capability check introduced in earlier versions to address a previous vulnerability. This flaw can lead to unauthorized extraction of sensitive database information without requiring user interaction.

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.0.19.8. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

The WP Simple Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.0.10. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.