CVE-2023-1977 — Booking Manager < 2.0.29 - Subscriber+ SSRF
The Booking Manager WordPress plugin before 2.0.29 does not validate URLs input in it's admin panel or in shortcodes for showing events from a remote .ics file, allowing an atta…
Published: 2023-08-16 · CVSS: Unscored
The Booking Manager WordPress plugin before 2.0.29 does not validate URLs input in it's admin panel or in shortcodes for showing events from a remote .ics file, allowing an attacker with privileges as low as Subscriber to perform SSRF attacks on the sites internal network.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7