Description
The Advanced Appointment Booking & Scheduling WordPress plugin before 2.7 does not verify the site's user-registration setting before creating accounts through a publicly accessible shortcode, allowing unauthenticated attackers to register arbitrary user accounts, and be automatically logged in, even when user registration is disabled on the site.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Advanced Appointment Booking & Scheduling | < 2.7 | 2.7 |
References
- https://wpscan.com/vulnerability/05f00d47-0014-456b-ade8-994113b5507c/ exploit vdb-entry technical-description