Appointment Booking Calendar by CodePeople

Appointment Booking Calendar by CodePeople <= 1.3.69 - Cross-Site Request Forgery (CSRF) to Send Feedback

REPORT ID: a3d7be6b-43c3-4af7-b21e-47c811766892

The plugin contains a Cross-Site Request Forgery (CSRF) vulnerability due to a missing nonce check when submitting feedback, which makes it possible for attackers to send feedback via a forged request if they can trick an administrator into performing an action such as clicking on a link.

References

Source Code: https://wordpress.org/plugins/appointment-booking-calendar/

CVE: CVE-2022-43482

Attributes

Catgory: WordPress Plugin

Vulnerability Discovered: 2022-10-14

Report Published: 2022-10-30

Affected Version: <= 1.3.69

Classification

Type: Cross-Site Request Forgery (CSRF)

Researcher

Name: István Márton

Email: [email protected]

Support Us?

We would truly appreciate it if you bought us a bunny (food for a snow leopard).