This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: BookingPress (v1.1.6-1.1.7) fails to verify identity **before** login after booking. π **Consequences**: Full system compromise. CVSS 9.8 (Critical).β¦
π‘οΈ **CWE-288**: Authentication Bypass. The core flaw is skipping proper identity validation steps. Users bypass security checks simply by completing a booking action first. π« No gatekeeping.
Q3Who is affected? (Versions/Components)
π’ **Vendor**: reputeinfosystems. π¦ **Product**: BookingPress (Appointment Booking Calendar & Scheduling). π **Affected**: Versions **1.1.6** to **1.1.7**. If you use these, you are exposed.
Q4What can hackers do? (Privileges/Data)
π» **Privileges**: Full access. π **Data**: High confidentiality & integrity impact. Hackers can read sensitive user data, alter bookings, and potentially crash the site. Itβs not just a peek; itβs a takeover.
Q5Is exploitation threshold high? (Auth/Config)
β‘ **Threshold**: LOW. π **Network**: Remote (AV:N). π **Auth**: None required (PR:N). π±οΈ **UI**: None required (UI:N). Any unauthenticated attacker can exploit this easily. No complex setup needed.
Q6Is there a public Exp? (PoC/Wild Exploitation)
π **Public Exp?**: No specific PoC code listed in data. π° **References**: WordFence and WordPress Trac links exist. β οΈ **Status**: Likely exploitable given the low barrier, but no public script confirmed yet.
Q7How to self-check? (Features/Scanning)
π **Check**: Scan for BookingPress plugin. π **Version**: Verify if installed version is 1.1.6 or 1.1.7. π οΈ **Tool**: Use WordPress security scanners or check plugin directory details.β¦
β **Fixed?**: Yes. π **Patch**: Reference to changeset 3130266 indicates a fix in `class.bookingpress_customers.php`. π **Action**: Update to the latest version immediately to close the hole.
Q9What if no patch? (Workaround)
π§ **No Patch?**: Disable the plugin temporarily. π **Block**: Restrict access to booking endpoints via WAF rules. π§Ή **Audit**: Monitor for unauthorized login attempts post-booking. Mitigation is key if you can't update.
Q10Is it urgent? (Priority Suggestion)
π₯ **Urgency**: CRITICAL. π¨ **Priority**: Patch NOW. CVSS 9.8 means high impact + easy exploit. Do not wait. Update BookingPress to the latest secure version today.