Unauthorized Appointment Status Change in Booking Calendar

Executive Summary

This vulnerability is a broken access control issue in the Booking for Appointments and Events Calendar WordPress plugin before version 2.4.9. It allows customers to change appointment statuses without proper capability checks, including approving their own pending bookings and overwriting others' statuses on shared appointments.

Useful 0 Not Useful 0

Detection Guidance

Check if your WordPress site uses the Booking for Appointments and Events Calendar plugin versions 1.2.32 to 2.4.8. Inspect plugin files for the Customer+ Appointment Status Update and Self-Approval feature. Look for unauthorized status changes in appointment logs or database entries.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to approve their own bookings that were awaiting approval, potentially gaining unauthorized access or manipulating appointment records. They could also overwrite another customer's booking status on a shared appointment, causing confusion or conflicts in scheduling.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Booking for Appointments and Events Calendar plugin to version 2.4.9 or later immediately. Remove or disable the plugin if an update is not possible. Review appointment statuses for unauthorized changes and restrict user permissions to prevent future misuse.

Useful 0 Not Useful 0