Description

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee (provider) is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-08-13T06:17:38.010Z",
  "pubdate": "2026-08-13T06:17:38.010Z",
  "executiveSummary": "An Insecure Direct Object Reference vulnerability exists in the Booking for Appointments and Events Calendar WordPress plugin prior to version 2.4.6. The flaw permits authenticated users with employee or provider privileges to read arbitrary appointment records by manipulating the appointment identifier in requests. This security deficiency leads to unauthorized disclosure of sensitive customer personal data, including personally identifiable information associated with bookings. The risk implication centers on data privacy violations and potential regulatory non-compliance, as lower-privileged internal accounts can exceed their data access boundaries. Exploitation requires the attacker to possess authenticated employee credentials within the target WordPress instance, but does not necessitate administrative privileges or assignment to the specific appointment being targeted. Remediation requires updating the affected plugin to version 2.4.6 or later to enforce proper access control checks.",
  "technicalDetails": "The vulnerability resides within the access control logic of the Booking for Appointments and Events Calendar WordPress plugin for versions before 2.4.6. Specifically, the application fails to perform adequate server-side authorization checks to verify whether an authenticated user holding an employee or provider role is explicitly assigned to the specific appointment identifier being requested. This architectural oversight manifests as an Insecure Direct Object Reference vulnerability, allowing direct interaction with database objects through predictable parameter manipulation.\nThe attack flow begins when an authenticated attacker with standard employee privileges identifies the parameter responsible for transmitting the appointment identifier within the application interface. By systematically iterating or directly substituting this appointment identifier in the access request, the attacker bypasses intended logical boundaries. Because the backend controller code lacks validation regarding the requester's relationship to the requested appointment entity, the application processes the query and returns the complete record containing the booked customer's personal data.\nThe vulnerable component handles appointment retrieval requests without enforcing contextual ownership or assignment matrices. The attack vector is exploitable over the network by any authenticated user possessing low-level provider or employee credentials. The post-exploitation impact includes the mass harvesting of customer personal data, leading to unauthorized information disclosure and potential privacy breaches across the affected WordPress deployment."
}