WP FEvents Book <= 0.46 – Subscriber+ Arbitrary Booking Manipulation via IDOR | CVE 2023-1129 | Plugin Vulnerabilities

Description

The plugin does not ensures that bookings to be updated belong to the user making the request, allowing any authenticated user to book, add notes, or cancel booking on behalf of other users.

Proof of Concept

1. Book (or cancel booking) an event using an authenticated user.
2. Intercept the request using an HTTP Proxy (e.g., BurpSuite).
3. Change the `idUser` parameter in the request, and forward it.

Note: Since the `idUser` value is an incremental numerical value, it is easily brute forced.

Affects Plugins

wp-fevents-book

No known fix

References

CVE

Classification

Type

IDOR

OWASP top 10

A5: Broken Access Control

CWE

CVSS

Miscellaneous

Original Researcher

Ameen Alkurdy

Submitter

Ameen Alkurdy

Submitter website

https://ameenalkurdy.github.io/

Submitter twitter

Verified

Yes

WPVDB ID

d40479de-fb04-41b8-9fb0-41b9eefbd8af

Timeline

Publicly Published

2023-04-03 (about 2 years ago)

Added

2023-04-03 (about 2 years ago)

Last Updated

2023-04-03 (about 2 years ago)

Other

Published

Title

Published

2024-04-05

Title

BookingPress < 1.0.82 - Authenticated (Customer+) Insecure Direct Object Reference

Published

2024-04-17

Title

Wp Ultimate Review < 2.3.0 - Unauthenticated Insecure Direct Object Reference

Published

2025-11-20

Title

Return Refund and Exchange For WooCommerce < 4.5.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Refund Request Cancellation

Published

2025-04-01

Title

User Registration & Membership (Free < 4.1.3, Pro < 5.1.3) - Authentication Bypass

Published

2024-03-26

Title

Event Tickets and Registration < 5.8.3 - Improper Authorization to Information Disclosure