Authentication Bypass Vulnerability in BookIt Plugin for WordPress

CVE-2023-2834

Summary

The BookIt plugin for WordPress contains a security flaw that allows unauthenticated attackers to bypass authentication checks. This vulnerability arises from inadequate verification of user identities during the appointment booking process. An attacker with access to an existing user's email could exploit this weakness to log in as that user, including administrators, potentially compromising the site's security. It affects all versions up to and including 2.3.7, making it critical for users to update to the latest version to mitigate the risk.

References