WordPress Plugin Vulnerabilities

BookingPress < 1.0.75 - Unauthenticated Booking Price Manipulation

Description

The plugin does not have proper validation in its bookingpress_confirm_booking, allowing unauthenticated user to modify the price of an appointment

Affects Plugins

Plugin icon
bookingpress-appointment-booking
Fixed in 1.0.75

References

CVE
CVE-2023-51405
URL
https://patchstack.com/database/vulnerability/bookingpress-appointment-booking/wordpress-bookingpress-plugin-1-0-74-booking-price-manipulation-vulnerability

Miscellaneous

Original Researcher
Abdi Pranata
Verified
No
WPVDB ID
07db47e5-38b8-472b-99d3-19ea4af67806

Timeline

Publicly Published
2024-01-27 (about 2 years ago)
Added
2024-01-05 (about 2 years ago)
Last Updated
2024-01-05 (about 2 years ago)

Other

Published
Title
Published
2014-08-01
Title
WordPress 2.0 - 3.0.1 wp-includes/comment.php Bypass Spam Restrictions
Published
2025-08-21
Title
Wp Edit Password Protected < 1.3.5 - Protection Bypass via REST API
Published
2015-07-13
Title
CP Image Store with Slideshow <= 1.0.6 - Purchase ID Brute Force Prevention
Published
2022-12-29
Title
Passster < 3.5.5.9 - Protection Bypass & Arbitrary Post Access
Published
2023-11-16
Title
AppPresser < 4.3.0 - Insecure Password Reset Mechanism