Medium · 5.0 CVE-2023-24407 EUVD-2023-28463GHSA-vm52-xw7f-3537

WordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Broken Access Control vulnerability

Published Dec 9, 2024 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: wpdevart Product: Booking calendar, Appointment Booking System

Description

Missing Authorization vulnerability in WpDevArt Booking calendar, Appointment Booking System allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking calendar, Appointment Booking System: from n/a through 3.2.3.

Affected products

Vendor	Product	Affected	Fixed
WpDevArt	Booking calendar, Appointment Booking System	≤ 3.2.3	—

References

https://patchstack.com/database/wordpress/plugin/booking-calendar/vulnerability/wordpress-booking-calendar-appointment-booking-system-plugin-3-2-3-broken-access-control?_s_id=cve vdb-entry