Unauthorized Option Disclosure in Booking Calendar WordPress Plugin

Executive Summary

The Booking Calendar WordPress plugin before version 11.8.3 has a flaw where users with the Editor role or higher can access and disclose sensitive WordPress site configuration details. This happens because the plugin does not properly restrict which options lower-privileged users can load through its settings handlers.

Useful 0 Not Useful 0

Detection Guidance

Check the installed version of the Booking Calendar plugin. If it is between 10.15 and 11.8.2, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the version.

Useful 0 Not Useful 0

Impact Analysis

If you use the affected plugin versions, an attacker with Editor access or higher could view confidential site settings, such as database credentials or API keys. This could lead to further attacks, data breaches, or unauthorized modifications to your WordPress site.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could expose sensitive data, potentially violating GDPR (if personal data is leaked) or HIPAA (if protected health information is compromised). Organizations may face legal penalties, reputational damage, and loss of trust due to non-compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Booking Calendar plugin to version 11.8.3 or later immediately. Restrict Editor role permissions if possible and monitor for unauthorized access or data disclosure attempts.

Useful 0 Not Useful 0