Description

The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee (provider) owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-08-26T06:16:24.800Z",
  "pubdate": "2026-08-26T06:16:24.800Z",
  "executiveSummary": "The Booking for Appointments and Events Calendar WordPress plugin contains an Insecure Direct Object Reference (IDOR) vulnerability that facilitates unauthorized account takeover. The flaw exists in the provider profile management functionality, where the application fails to perform adequate authorization checks to ensure that the authenticated user possesses the rights to modify a specific provider account.\nThis vulnerability allows an authenticated user with an 'Employee Panel' login to craft malicious requests that target the account identifiers of other providers. By manipulating request parameters, an attacker can overwrite the passwords of arbitrary provider accounts, effectively granting the attacker full control over those accounts.\nThe risk is critical for multi-user WordPress environments where administrative segregation is required. An attacker with standard employee-level access can escalate privileges by compromising administrator-level or higher-privileged provider accounts. The vulnerability is present in versions prior to 9.8, necessitating an immediate update to the latest version to mitigate the risk of unauthorized access and potential data exposure.",
  "technicalDetails": "The vulnerability originates from a missing authorization check within the profile update logic of the Booking for Appointments and Events Calendar plugin. In affected versions (pre-9.8), the backend process responsible for processing provider password updates fails to validate the ownership of the account being modified against the current session's authenticated user ID.\nThe attack flow proceeds as follows: An attacker authenticated with a valid Employee Panel account intercepts the request sent to the plugin's profile update endpoint. When the user updates their own password, the request typically includes a parameter specifying the target provider's ID or unique identifier. Because the server-side code relies solely on the user-supplied identifier to execute an UPDATE query on the database, it fails to verify if the 'current_user_id' matches the 'target_provider_id'.\nAn attacker can systematically exploit this by identifying the ID associated with a target account and sending a POST request to the update handler, substituting the victim's account identifier into the parameters. The application processes the request, updates the password hash in the database associated with the target victim, and confirms the change. This results in the immediate invalidation of the victim's legitimate credentials and allows the attacker to authenticate as the victim using the newly set password.\nBecause this operation occurs via standard administrative HTTP requests within the plugin's environment, it requires a valid 'Employee' session. However, it does not require administrative privileges within the WordPress core; it only requires access to the plugin's specific Employee Panel. This horizontal privilege escalation leads to vertical escalation if the attacker targets a provider with higher administrative permissions within the plugin architecture. Post-exploitation impact includes unauthorized access to customer booking data, scheduling manipulation, and potential exfiltration of sensitive information managed within the plugin's cabinet interface. The lack of server-side validation acts as the root cause, transforming an intended profile update function into an arbitrary account takeover primitive."
}