Missing Authorization Vulnerability Affects WP Time Slots Booking Form
CVE-2024-35735

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
WP Time Slots Booking Form
Vendor
CVE Published:
10 June 2024

What is CVE-2024-35735?

A critical vulnerability exists in the WP Time Slots Booking Form by CodePeople due to missing authorization checks. This oversight can allow unauthorized users to access or manipulate functionalities intended for privileged users only. The issue adversely impacts versions from n/a up to 1.2.11, emphasizing the importance of employing strict access controls to safeguard against potential exploitation. Proper authorization mechanisms should be in place to protect sensitive data and ensure that only authorized individuals can perform critical actions within the application.

Affected Version(s)

WP Time Slots Booking Form <= 1.2.11

References

https://patchstack.com/database/vulnerability/wp-time-slo...
vdb-entry

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Manab Jyoti Dowarah (Patchstack Alliance)
.