Unrated severityNVD Advisory· Published Jan 2, 2023· Updated Apr 10, 2025
BookingPress < 1.0.31 - Unauthenticated IDOR in appointment_id
CVE-2022-4340
Description
The BookingPress WordPress plugin before 1.0.31 suffers from an Insecure Direct Object Reference (IDOR) vulnerability in it's thank you page, allowing any visitor to display information about any booking, including full name, date, time and service booked, by manipulating the appointment_id query parameter.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2(expand)+ 1 more
- (no CPE)
- (no CPE)range: <1.0.31
Patches
Vulnerability mechanics
References
1- wpscan.com/vulnerability/8a7bd9f6-2789-474b-a237-01c643fdfba7mitreexploitvdb-entrytechnical-description
News mentions
0No linked articles in our index yet.