Privilege Escalation via Account Takeover in Appointments Booking Calendar Plugin for WordPress

CVE-2024-13677

What is CVE-2024-13677?

The Appointments Booking Calendar Plugin for WordPress is susceptible to a privilege escalation vulnerability that allows authenticated attackers with subscriber-level access and above to exploit the plugin's inadequate user identity validation. This flaw permits them to change email addresses of arbitrary users, including those of administrators. By exploiting this vulnerability, attackers can reset passwords and gain unauthorized access to user accounts, posing significant security risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References