CVE-2023-36507 WordPress BookingPress Plugin <= 1.0.64 is vulnerable to Sensitive Data Exposure

What is CVE-2023-36507?

CVE-2023-36507 is a medium-severity vulnerability in Repute Infosystems BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin, published on 30 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Repute Infosystems BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin.This issue affects BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin: from n/a through 1.0.64.

Weakness: CWE-200

Which versions are affected by CVE-2023-36507?

It affects 1 product.

Products include Reputeinfosystems Bookingpress.

How do I fix CVE-2023-36507?

No fix has been published for CVE-2023-36507 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-36507 being exploited?

There is no known exploitation of CVE-2023-36507 in the wild and no public exploit code.

Other vulnerabilities in Repute Infosystems BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin

• CVE-2022-0739 BookingPress < 1.0.11 - Unauthenticated SQL Injection Critical 9.8
• CVE-2024-6467 BookingPress Appointment Booking <= 1.1.5 - Authenticated (Subscriber+) Arbitrary File Read to Arbitrary File Creation High 8.8
• CVE-2024-6660 Missing authorization in Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress High 8.8
• CVE-2023-50841 WordPress BookingPress Plugin <= 1.0.72 is vulnerable to SQL Injection High 8.5
• CVE-2023-51405 WordPress BookingPress plugin <= 1.0.74 - Booking Price Manipulation vulnerability High 8.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-74vc-j4wc-8j2h.