Privilege Escalation via Account Takeover in Appointments Booking Calendar Plugin for WordPress

CVE-2024-13677

Summary

The Appointments Booking Calendar Plugin for WordPress is susceptible to a privilege escalation vulnerability that allows authenticated attackers with subscriber-level access and above to exploit the plugin's inadequate user identity validation. This flaw permits them to change email addresses of arbitrary users, including those of administrators. By exploiting this vulnerability, attackers can reset passwords and gain unauthorized access to user accounts, posing significant security risks.

References