WordPress Plugin Vulnerabilities

Pinpoint Booking System < 2.9.9.5.8 - Missing Authorization

Description

The plugin is vulnerable to unauthorized access due to a missing capability check on a function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
booking-system
Fixed in 2.9.9.5.8

References

CVE
CVE-2024-54252
URL
https://patchstack.com/database/wordpress/plugin/booking-system/vulnerability/wordpress-pinpoint-booking-system-plugin-2-9-9-5-2-broken-access-control-vulnerability

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
Muhammad Daffa
Verified
No
WPVDB ID
e6561605-00ce-401e-8e40-988897700c00

Timeline

Publicly Published
2024-12-05 (about 1 year ago)
Added
2025-01-17 (about 1 year ago)
Last Updated
2025-09-20 (about 8 months ago)

Other

Published
Title
Published
2025-02-23
Title
Small Package Quotes – Unishippers Edition < 2.4.10 - Missing Authorization
Published
2023-10-25
Title
WP Word Count <= 3.2.4 - Missing Authorization via calculate_statistics
Published
2024-09-05
Title
AI Assistant with ChatGPT by AYS <= 2.0.9 - Unauthenticated AJAX Calls
Published
2026-01-08
Title
Ultimate Gift Cards for WooCommerce < 3.2.5 - Missing Authorization
Published
2023-08-09
Title
EmbedPress < 3.8.3 - Subscriber+ Plugin Settings Delete