Appointment Hour Booking <= 1.4.23 is vulnerable to Broken Access Control vulnerability

Unauthenticated

Published
2023-10-10

The Appointment Hour Booking plugin for WordPress is vulnerable to unauthorized double booking due to insufficient validation on the data_management() function in versions up to, and including, 1.4.23. This makes it possible for unauthenticated attackers to make double bookings.

CVE

https://www.cve.org/CVERecord?id=CVE-2023-45649

CVSS

Score:5.3

Severity:Medium

Version: 1.4.23

There is a patch available in v1.4.24 and we strongly recommend you update to this version as soon as possible.