CVE-2023-1129 — WP FEvents Book <= 0.46 - Subscriber+ Arbitrary Booking Manipulation via IDOR
The WP FEvents Book WordPress plugin through 0.46 does not ensures that bookings to be updated belong to the user making the request, allowing any authenticated user to book, ad…
Published: 2023-04-24 · CVSS: 6.5 · CVSS 3.1
The WP FEvents Book WordPress plugin through 0.46 does not ensures that bookings to be updated belong to the user making the request, allowing any authenticated user to book, add notes, or cancel booking on behalf of other users.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7