WordPress Plugin Vulnerabilities

Appointment Booking Calendar < 1.3.93 - Missing Authorization

Description

The Appointment Booking Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.3.92. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
appointment-booking-calendar
Fixed in 1.3.93

References

CVE
CVE-2025-46247
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/59178e0f-1bf3-4208-a14e-d0cac0de8dbd

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
timomangcut
Verified
No
WPVDB ID
e124956f-80eb-4d00-b335-c4b23c67a6a4

Timeline

Publicly Published
2025-04-22 (about 1 year ago)
Added
2025-04-30 (about 1 year ago)
Last Updated
2025-04-30 (about 1 year ago)

Other

Published
Title
Published
2022-09-05
Title
Ldap WP Login / Active Directory Integration < 3.0.2 - Unauthenticated Settings Update to Auth Bypass
Published
2026-02-24
Title
Post Duplicator < 3.0.9 - Missing Authorization to Authenticated (Contributor+) Protected Post Meta Insertion via 'customMetaData' Parameter
Published
2025-06-05
Title
BM Content Builder < 3.16.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via ux_cb_page_options_save
Published
2026-06-03
Title
Rank Math SEO < 1.0.271.1 - Missing Authorization
Published
2023-10-04
Title
Customer Reviews for WooCommerce < 5.36.1 - Missing Authorization