CVE-2024-0856 - Vulnerability Details - OpenCVE

The Appointment Booking Calendar WordPress plugin before 1.3.83 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding a booking to the calendar without paying.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Codepeople	Appointment Booking Calendar

Configuration 1 [-]

cpe:2.3:a:codepeople:appointment_booking_calendar:*:*:*:*:*:wordpress:*:*

No data.

References

Link	Providers
https://wpscan.com/vulnerability/eb383600-0cff-4f24-8127-1fb118f0565a/

History

Mon, 05 May 2025 19:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Codepeople Codepeople appointment Booking Calendar
Weaknesses		CWE-352
CPEs		cpe:2.3:a:codepeople:appointment_booking_calendar::::::wordpress::*
Vendors & Products		Codepeople Codepeople appointment Booking Calendar

MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2024-03-20T05:00:02.675Z

Updated: 2024-08-05T18:06:03.929Z

Reserved: 2024-01-24T11:38:06.130Z

Link: CVE-2024-0856

Vulnrichment

Updated: 2024-08-01T18:18:18.979Z

NVD

Status : Analyzed

Published: 2024-03-20T05:15:45.433

Modified: 2025-05-05T18:41:08.043

Link: CVE-2024-0856

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-0856", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2024-01-24T11:38:06.130Z", "datePublished": "2024-03-20T05:00:02.675Z", "dateUpdated": "2024-08-05T18:06:03.929Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2024-03-20T05:00:02.675Z"}, "title": "Booking Calendar < 1.3.83 - CSRF appointment scheduling", "problemTypes": [{"descriptions": [{"description": "CWE-352 Cross-Site Request Forgery (CSRF)", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "Appointment Booking Calendar", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "1.3.83"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Appointment Booking Calendar WordPress plugin before 1.3.83 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding a booking to the calendar without paying."}], "references": [{"url": "https://wpscan.com/vulnerability/eb383600-0cff-4f24-8127-1fb118f0565a/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Sushil Phuyal", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:18:18.979Z"}, "title": "CVE Program Container", "references": [{"url": "https://wpscan.com/vulnerability/eb383600-0cff-4f24-8127-1fb118f0565a/", "tags": ["exploit", "vdb-entry", "technical-description", "x_transferred"]}]}, {"affected": [{"vendor": "codepeople", "product": "appointment_booking_calendar", "cpes": ["cpe:2.3:a:codepeople:appointment_booking_calendar:*:*:*:*:*:wordpress:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "1.3.83", "versionType": "semver"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-08-05T18:02:21.787624Z", "id": "CVE-2024-0856", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-05T18:06:03.929Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://wpscan.com/vulnerability/eb383600-0cff-4f24-8127-1fb118f0565a/", "tags": ["exploit", "vdb-entry", "technical-description", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:18:18.979Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-0856", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-08-05T18:02:21.787624Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:codepeople:appointment_booking_calendar:*:*:*:*:*:wordpress:*:*"], "vendor": "codepeople", "product": "appointment_booking_calendar", "versions": [{"status": "affected", "version": "0", "lessThan": "1.3.83", "versionType": "semver"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-05T18:05:51.930Z"}}], "cna": {"title": "Booking Calendar < 1.3.83 - CSRF appointment scheduling", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Sushil Phuyal"}, {"lang": "en", "type": "coordinator", "value": "WPScan"}], "affected": [{"vendor": "Unknown", "product": "Appointment Booking Calendar", "versions": [{"status": "affected", "version": "0", "lessThan": "1.3.83", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://wpscan.com/vulnerability/eb383600-0cff-4f24-8127-1fb118f0565a/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "x_generator": {"engine": "WPScan CVE Generator"}, "descriptions": [{"lang": "en", "value": "The Appointment Booking Calendar WordPress plugin before 1.3.83 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding a booking to the calendar without paying."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2024-03-20T05:00:02.675Z"}}}, "cveMetadata": {"cveId": "CVE-2024-0856", "state": "PUBLISHED", "dateUpdated": "2024-08-05T18:06:03.929Z", "dateReserved": "2024-01-24T11:38:06.130Z", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "datePublished": "2024-03-20T05:00:02.675Z", "assignerShortName": "WPScan"}, "dataVersion": "5.1"}