Unauthenticated Information Disclosure in Booking Package WordPress Plugin

Executive Summary

This vulnerability in the Booking Package WordPress plugin before version 1.7.31 allows unauthenticated users to access sensitive calendar account configuration details without proper authorization checks. Attackers can disclose confidential settings, including the administrator's notification email addresses.

Useful 0 Not Useful 0

Detection Guidance

Check if the Booking Package WordPress plugin version is below 1.7.31. Use WPScan to detect vulnerable versions with: wpscan --url <target-url> --enumerate vp,vt. Alternatively, inspect plugin files for missing authorization checks in calendar-account configuration endpoints.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to obtain sensitive information such as administrator email addresses, potentially leading to further attacks like phishing or unauthorized access to other systems.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may lead to non-compliance with data protection regulations like GDPR or HIPAA by exposing personal or sensitive data without authorization, potentially resulting in legal penalties or reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Booking Package plugin to version 1.7.31 or later immediately. If updating is not possible, consider disabling the plugin temporarily until an update is applied. Review exposed administrator email addresses and reset them if compromised.

Useful 0 Not Useful 0