CVE-2023-2414: Online Booking & Scheduling Calendar for WordPress by vcita <= 4.4.6 - Missing Authorization to Settings Update and Arbitrary File Upload
First published: Fri Jun 09 2023(Updated: )
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_save_settings_callback function in versions up to, and including, 4.2.10. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to modify the plugins settings, upload media files, and inject malicious JavaScript.
Credit: security@wordfence.com security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Vcita Online Booking & Scheduling Calendar | <=4.2.10 | |
| Vcita Online Booking & Scheduling Calendar | <=4.4.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita
- https://plugins.trac.wordpress.org/browser/meeting-scheduler-by-vcita/trunk/vcita-ajax-function.php#L88
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3c99aab5-a995-44ae-bc14-09f73e6b22c5?source=cve
- https://plugins.trac.wordpress.org/changeset/2933915/meeting-scheduler-by-vcita/trunk/vcita-ajax-function.php?contextall=1&old=2924763&old_path=%2Fmeeting-scheduler-by-vcita%2Ftrunk%2Fvcita-ajax-function.php
Frequently Asked Questions
What is CVE-2023-2414?
CVE-2023-2414 is a vulnerability in the Online Booking & Scheduling Calendar for WordPress by vcita plugin, which allows unauthorized modification of data.
What is the severity of CVE-2023-2414?
CVE-2023-2414 has a severity rating of 4.3, which is considered medium.
How does CVE-2023-2414 affect the Online Booking & Scheduling Calendar for WordPress by vcita plugin?
CVE-2023-2414 allows authenticated attackers to modify data without proper authorization.
Which versions of the Online Booking & Scheduling Calendar for WordPress by vcita plugin are affected by CVE-2023-2414?
Versions up to and including 4.2.10 of the Online Booking & Scheduling Calendar for WordPress by vcita plugin are affected by CVE-2023-2414.
How can I fix CVE-2023-2414?
To fix CVE-2023-2414, update your Online Booking & Scheduling Calendar for WordPress by vcita plugin to a version higher than 4.2.10.
- agent/type
- agent/severity
- agent/weakness
- agent/first-publish-date
- agent/event
- agent/title
- agent/references
- agent/description
- agent/author
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/vcita
- canonical/vcita online booking & scheduling calendar
- version/vcita online booking & scheduling calendar/4.2.10
- version/vcita online booking & scheduling calendar/4.4.6