CVE-2022-4036: codepeople appointment hour booking – booking calendar Inadequate Encryption Strength
Vulnerability summary
CVE-2022-4036 is a medium (CVSS 5.3) Inadequate Encryption Strength vulnerability in codepeople appointment hour booking – booking calendar. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 39.9% of scored vulnerabilities. Fixed in 1.3.73.
Timeline
- 29-11-2022PublishedVulnerability first disclosed.
- 08-04-2026Last modifiedVulnerability information updated.
Description
The Appointment Hour Booking plugin for WordPress is vulnerable to CAPTCHA bypass in versions up to, and including, 1.3.72. This is due to the use of insufficiently strong hashing algorithm on the CAPTCHA secret that is also displayed to the user via a cookie.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- wordfenceSource5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.47%
Chance of exploitation in the next 30 days
Percentile
40%
Versus all other CVEs
30-day change
+0.02 pp
From 0.46% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-326Inadequate Encryption StrengthThe product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
- CWE-804Guessable CAPTCHAThe product uses a CAPTCHA challenge, but the challenge can be guessed or automatically recognized by a non-human actor.
Affected systems
Codepeople1 product
Dwbooster1 product
- appointment_hour_booking≤ 1.3.72
Wordpress1 product
- appointment-hour-booking≤ 1.3.72 (fixed in 1.3.73)
3 vendors · 3 products
References
4 links- www.wordfence.com/vulnerability-advisories-continued/Third Party Advisory