CVE-2023-2299: Online Booking & Scheduling Calendar for WordPress by vcita <= 4.4.2 - Missing Authorization on REST-API
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized medication of data via the /wp-json/vcita-wordpress/v1/actions/auth REST-API endpoint in versions up to, and including, 4.2.10 due to a missing capability check on the processAction function. This makes it possible for unauthenticated attackers modify the plugin's settings.
Other sources
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized medication of data via the /wp-json/vcita-wordpress/v1/actions/auth REST-API endpoint in versions up to, and including, 4.4.2 due to a missing capability check on the processAction function. This makes it possible for unauthenticated attackers modify the plugin's settings.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-2299?
CVE-2023-2299 is a vulnerability in the Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress.
How does CVE-2023-2299 affect the plugin?
CVE-2023-2299 allows unauthorized manipulation of data through the /wp-json/vcita-wordpress/v1/actions/auth REST-API endpoint in versions up to, and including, 4.2.10.
What is the severity of CVE-2023-2299?
The severity of CVE-2023-2299 is medium, with a CVSS score of 5.3.
How can I fix CVE-2023-2299?
To fix CVE-2023-2299, it is recommended to update the Online Booking & Scheduling Calendar for WordPress by vcita plugin to a version higher than 4.2.10.
Is there any additional information about CVE-2023-2299?
For more information about CVE-2023-2299, you can refer to the following sources: [link1], [link2], [link3].