CVE-2024-7350: reputeinfosystems appointment booking calendar plugin and scheduling plugin – bookingpress
Vulnerability summary
CVE-2024-7350 is a critical (CVSS 9.8) vulnerability in reputeinfosystems appointment booking calendar plugin and scheduling plugin – bookingpress. EPSS estimates a 0.66% chance of exploitation in the next 30 days, higher than 50.7% of scored vulnerabilities. Fixed in 1.1.8.
Timeline
- 08-08-2024PublishedVulnerability first disclosed.
- 08-08-2024Last modifiedVulnerability information updated.
Description
The Appointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress plugin for WordPress is vulnerable to authentication bypass in versions 1.1.6 to 1.1.7. This is due to the plugin not properly verifying a user's identity prior to logging them in when completing a booking. This makes it possible for unauthenticated attackers to log in as registered users, including administrators, if they have access to that user's email. This is only exploitable when the 'Auto login user after successful booking' setting is enabled.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- wordfenceSource9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.66%
Chance of exploitation in the next 30 days
Percentile
51%
Versus all other CVEs
30-day change
0.00 pp
From 0.66% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Reputeinfosystems1 product
Wordpress1 product
- bookingpress-appointment-booking≥ 1.1.6, ≤ 1.1.7 (fixed in 1.1.8)
2 vendors · 2 products