Unauthenticated User Registration in Advanced Appointment Booking WordPress Plugin

Executive Summary

The Advanced Appointment Booking & Scheduling WordPress plugin before version 2.7 has a flaw where it does not check if user registration is enabled on the site before creating accounts through a public shortcode. This allows unauthenticated attackers to register arbitrary user accounts and be automatically logged in, even when registration is disabled.

Useful 0 Not Useful 0

Detection Guidance

Check if the Advanced Appointment Booking & Scheduling WordPress plugin version is below 2.7. You can use commands like 'wp plugin list' in the WordPress directory or inspect the plugin files for version details.

Useful 0 Not Useful 0

Impact Analysis

Attackers can exploit this to gain unauthorized access to your WordPress site, potentially taking control of it, stealing data, or performing malicious actions. Since accounts are created automatically, there is no need for user registration to be enabled.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access, potentially violating data protection requirements under GDPR or HIPAA if sensitive user or patient data is exposed. Unauthorized account creation may also breach compliance with access control policies.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Advanced Appointment Booking & Scheduling plugin to version 2.7 or later immediately. Disable user registration if not needed or restrict it to prevent unauthorized account creation.

Useful 0 Not Useful 0