CVE-2024-1760: Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.6.20 - Cross-Site Request Forgery to Plugin Data Reset
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.6.20. This is due to missing or incorrect nonce validation on the ssafactoryreset() function. This makes it possible for unauthenticated attackers to reset the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1760?
CVE-2024-1760 is classified as a Cross-Site Request Forgery (CSRF) vulnerability, posing moderate risk due to missing nonce validation.
How do I fix CVE-2024-1760?
To fix CVE-2024-1760, update the Simply Schedule Appointments Booking Plugin to version 1.6.6.21 or later.
What versions are affected by CVE-2024-1760?
CVE-2024-1760 affects all versions of Simply Schedule Appointments up to and including 1.6.6.20.
What is Cross-Site Request Forgery in the context of CVE-2024-1760?
Cross-Site Request Forgery in CVE-2024-1760 allows attackers to execute unauthorized actions on behalf of authenticated users due to inadequate validation.
Are there any known exploits for CVE-2024-1760?
As of now, there are no publicly disclosed exploits for CVE-2024-1760, but it is important to address the vulnerability promptly for security.