CVE-2022-4340 BookingPress < 1.0.31 - Unauthenticated IDOR in appointment_id

What is CVE-2022-4340?

CVE-2022-4340 is a medium-severity vulnerability in Unknown BookingPress, published on 2 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The BookingPress WordPress plugin before 1.0.31 suffers from an Insecure Direct Object Reference (IDOR) vulnerability in it's thank you page, allowing any visitor to display information about any booking, including full name, date, time and service booked, by manipulating the appointment_id query parameter.

Which versions are affected by CVE-2022-4340?

It affects 1 product.

Products include Reputeinfosystems Bookingpress.

How do I fix CVE-2022-4340?

No fix has been published for CVE-2022-4340 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-4340 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-4340 exists.

Other vulnerabilities in Unknown BookingPress

• CVE-2022-0739 BookingPress < 1.0.11 - Unauthenticated SQL Injection Critical 9.8
• CVE-2024-6467 BookingPress Appointment Booking <= 1.1.5 - Authenticated (Subscriber+) Arbitrary File Read to Arbitrary File Creation High 8.8
• CVE-2024-6660 Missing authorization in Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress High 8.8
• CVE-2023-50841 WordPress BookingPress Plugin <= 1.0.72 is vulnerable to SQL Injection High 8.5
• CVE-2023-51405 WordPress BookingPress plugin <= 1.0.74 - Booking Price Manipulation vulnerability High 8.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-7j9f-fw49-x4p8.