Medium severity5.3NVD Advisory· Published Jan 2, 2023· Updated Jun 17, 2026

CVE-2022-4340

Description

The BookingPress WordPress plugin before 1.0.31 suffers from an Insecure Direct Object Reference (IDOR) vulnerability in it's thank you page, allowing any visitor to display information about any booking, including full name, date, time and service booked, by manipulating the appointment_id query parameter.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Reputeinfosystems/Bookingpress
cpe:2.3:a:reputeinfosystems:bookingpress:*:*:*:*:*:wordpress:*:*
Range: <1.0.31
WordPress/Bookingpresscpe-rescue2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <1.0.31
Package: https://wordpress.org/plugins/bookingpress

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/8a7bd9f6-2789-474b-a237-01c643fdfba7nvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000