← CVE Intelligence

CVE-2023-1129

WP FEvents Book <= 0.46 - Subscriber+ Arbitrary Booking Manipulation via IDOR PUBLISHED

Description (CNA)

The WP FEvents Book WordPress plugin through 0.46 does not ensures that bookings to be updated belong to the user making the request, allowing any authenticated user to book, add notes, or cancel booking on behalf of other users.

Affected (CNA)

Vendor / productVersions
Unknown / WP FEvents Bookaffected 0 through 0.46

CWE

No CWE identifiers supplied.

References

ADP enrichment

CVE

No English description supplied.

CISA-ADP

No English description supplied.

No references supplied.