High severity8.8NVD Advisory· Published Mar 20, 2024· Updated Jun 17, 2026

CVE-2024-0856

Description

The Appointment Booking Calendar WordPress plugin before 1.3.83 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding a booking to the calendar without paying.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Codepeople/Appointment Booking Calendar
cpe:2.3:a:codepeople:appointment_booking_calendar:*:*:*:*:*:wordpress:*:*
Range: <1.3.83
WordPress/Appointment Booking Calendarllm-fuzzy2 versions
<1.3.83+ 1 more
- (no CPE)range: <1.3.83
- (no CPE)
Package: https://wordpress.org/plugins/appointment-booking-calendar

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/eb383600-0cff-4f24-8127-1fb118f0565a/nvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000