blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2024-7350

CRITICAL 9.8 CVSS 3.1
Published
August 8, 2024
Last modified
June 17, 2026
NVD status
Deferred
Reported by
security@wordfence.com
Weakness
CWE-288
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The Appointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress plugin for WordPress is vulnerable to authentication bypass in versions 1.1.6 to 1.1.7. This is due to the plugin not properly verifying a user's identity prior to logging them in when completing a booking. This makes it possible for unauthenticated attackers to log in as registered users, including administrators, if they have access to that user's email. This is only exploitable when the 'Auto login user after successful booking' setting is enabled.

Affected WordPress components

  • bookingpress-appointment-booking Plugin · bookingpress-appointment-booking
    Confirmed match Homeless
    From 1.1.6 (including) to 1.1.7 (including)
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • reputeinfosystems Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress — From 1.1.6 (including) to 1.1.7 (including)
  • reputeinfosystems appointment_booking_calendar_plugin_and_scheduling_plugin_bookingpress — From 1.1.6 (including) to 1.1.7 (including)

References

  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/bookingpress-appointment-booking/trunk/core/classes/class.bookingpress_customers.php#L339
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3130266/bookingpress-appointment-booking/trunk/core/classes/class.bookingpress_customers.php
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/4c367565-75f7-4dd7-a2f1-111df581bd7a?source=cve
  • nvd.nist.gov Official NVD record