CVE-2023-2415: Online Booking & Scheduling Calendar for WordPress by vcita <= 4.2.10 - Missing Authorization to Account Logout
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcitalogoutcallback function in versions up to, and including, 4.2.10. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to logout a vctia connected account which would cause a denial of service on the appointment scheduler.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this security issue?
The vulnerability ID for this security issue is CVE-2023-2415.
What is the title of this vulnerability?
The title of this vulnerability is 'The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data'.
What is the severity rating for this vulnerability?
The severity rating for this vulnerability is medium with a CVSS score of 5.4.
What is the affected software?
The affected software is the Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress in versions up to and including 4.2.10.
How can an attacker exploit this vulnerability?
An authenticated attacker can exploit this vulnerability to perform unauthorized modification of data.