CVE-2024-12274 BookingPress < 1.1.23 - Unauthenticated Export File Download

What is CVE-2024-12274?

CVE-2024-12274 is a high-severity vulnerability in Unknown Appointment Booking Calendar Plugin and Scheduling Plugin, published on 13 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.1.23 export settings functionality exports data to a public folder, with an easily guessable file name, allowing unauthenticated attackers to access the exported files (if they exist).

Which versions are affected by CVE-2024-12274?

It affects 1 product.

Products include Codepeople Appointment Booking Calendar.

How do I fix CVE-2024-12274?

No fix has been published for CVE-2024-12274 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-12274 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-12274 exists.

Other vulnerabilities in Unknown Appointment Booking Calendar Plugin and Scheduling Plugin

• CVE-2016-10916 SQL injection in n/a Critical 9.8
• CVE-2024-0856 Booking Calendar < 1.3.83 - CSRF appointment scheduling High 8.8
• CVE-2025-46241 WordPress Appointment Booking Calendar plugin <= 1.3.92 - CSRF to SQL Injection vulnerability High 8.2
• CVE-2020-9372 Code injection in n/a High 7.8
• CVE-2015-7319 SQL injection in n/a High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-pw9j-qgmc-g62h.