CVE-2023-2414: Online Booking & Scheduling Calendar for WordPress by vcita <= 4.4.6 - Missing Authorization to Settings Update and Arbitrary File Upload
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcitasavesettingscallback function in versions up to, and including, 4.2.10. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to modify the plugins settings, upload media files, and inject malicious JavaScript.
Other sources
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcitasavesettingscallback function in versions up to, and including, 4.4.6. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to modify the plugins settings, upload arbitrary files, and inject malicious JavaScript (before 4.3.2).
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-2414?
CVE-2023-2414 is a vulnerability in the Online Booking & Scheduling Calendar for WordPress by vcita plugin, which allows unauthorized modification of data.
What is the severity of CVE-2023-2414?
CVE-2023-2414 has a severity rating of 4.3, which is considered medium.
How does CVE-2023-2414 affect the Online Booking & Scheduling Calendar for WordPress by vcita plugin?
CVE-2023-2414 allows authenticated attackers to modify data without proper authorization.
Which versions of the Online Booking & Scheduling Calendar for WordPress by vcita plugin are affected by CVE-2023-2414?
Versions up to and including 4.2.10 of the Online Booking & Scheduling Calendar for WordPress by vcita plugin are affected by CVE-2023-2414.
How can I fix CVE-2023-2414?
To fix CVE-2023-2414, update your Online Booking & Scheduling Calendar for WordPress by vcita plugin to a version higher than 4.2.10.