Unauthorized Modification of Data in Webba Booking Calendar Plugin

CVE-2024-8432

Summary

The Webba Booking plugin for WordPress contains a vulnerability that allows authenticated attackers with Subscriber-level access or higher to alter the booking form's CSS. The issue stems from a missing capability check in the save_appearance() function, which poses a significant security risk by enabling unauthorized changes to the appearance of booking forms. This vulnerability affects all versions of the plugin up to and including 5.0.48, potentially leading to a compromised user experience and data integrity.

References