WooCommerce Booking & Appointment Plugin Authenticated Arbitrary Option Update Vulnerability

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: Booking & Appointment Plugin for WooCommerce <= 6.9.0 - Authenticated (Subscriber+) Arbitrary Option Update 2. Vulnerability Type: Improper Authorization 3. CVSS Score: 8.8 (High) 4. Public Disclosure Date: November 25, 2024 5. Last Updated Date: November 26, 2024 6. Researcher: István Márton - Wordfence 7. Affected Versions: <= 6.9.0 8. Fixed Version: 6.10.0 9. Remediation: Update to version 6.10.0 or a later fixed version. 10. Vulnerability Description: Due to a missing authorization check on the function in versions up to and including 6.9.0, unauthorized data modification is possible. An attacker with subscriber-level permissions or higher can arbitrarily update site options. 11. Reference Link: www.tychesoftware.com 12. Vulnerability Database: Wordfence Intelligence Vulnerability Database 13. Vulnerability Score: 8.8 (High) 14. Vulnerability Disclosure Status: Public 15. Vulnerability Disclosure Date: November 25, 2024 16. Vulnerability Last Updated Date: November 26, 2024 17. Researcher: István Márton - Wordfence 18. Affected Versions: <= 6.9.0 19. Fixed Version: 6.10.0 20. Remediation: Update to version 6.10.0 or a later fixed version. 21. Vulnerability Description: Due to a missing authorization check on the function in versions up to and including 6.9.0, unauthorized data modification is possible. An attacker with subscriber-level permissions or higher can arbitrarily update site options. 22. Reference Link: www.tychesoftware.com 23. Vulnerability Database: Wordfence Intelligence Vulnerability Database 24. Vulnerability Score: 8.8 (High) 25. Vulnerability Disclosure Status: Public 26. Vulnerability Disclosure Date: November 25, 2024 27. Vulnerability Last Updated Date: November 26, 2024 28. Researcher: István Márton - Wordfence 29. Affected Versions: <= 6.9.0 30. Fixed Version: 6.10.0 31. Remediation: Update to version 6.10.0 or a later fixed version. 32. Vulnerability Description: Due to a missing authorization check on the function in versions up to and including 6.9.0, unauthorized data modification is possible. An attacker with subscriber-level permissions or higher can arbitrarily update site options. 33. Reference Link: www.tychesoftware.com 34. Vulnerability Database: Wordfence Intelligence Vulnerability Database 35. Vulnerability Score: 8.8 (High) 36. Vulnerability Disclosure Status: Public 37. Vulnerability Disclosure Date: November 25, 2024 38. Vulnerability Last Updated Date: November 26, 2024 39. Researcher: István Márton - Wordfence 40. Affected Versions: <= 6.9.0 41. Fixed Version: 6.10.0 42. Remediation: Update to version 6.10.0 or a later fixed version. 43. Vulnerability Description: Due to a missing authorization check on the function in versions up to and including 6.9.0, unauthorized data modification is possible. An attacker with subscriber-level permissions or higher can arbitrarily update site options. 44. Reference Link: www.tychesoftware.com 45. Vulnerability Database: Wordfence Intelligence Vulnerability Database 46. Vulnerability Score: 8.8 (High) 47. Vulnerability Disclosure Status: Public 48. Vulnerability Disclosure Date: November 25, 2024 49. Vulnerability Last Updated Date: November 26, 2024 50. Researcher: István Márton - Wordfence 51. Affected Versions: <= 6.9.0 52. Fixed Version: 6.10.0 53. Remediation: Update to version 6.10.0 or a later fixed version. 54. Vulnerability Description: Due to a missing authorization check on the function in versions up to and including 6.9.0, unauthorized data modification is possible. An attacker with subscriber-level permissions or higher can arbitrarily update site options. 55. Reference Link: www.tychesoftware.com 56. Vulnerability Database: Wordfence Intelligence Vulnerability Database 57. Vulnerability Score: 8.8 (High) 58. Vulnerability Disclosure Status: Public 59. Vulnerability Disclosure Date: November 25, 2024 60. Vulnerability Last Updated Date: November 26, 2024 61. Researcher: István Márton - Wordfence 62. Affected Versions: <= 6.9.0 63. Fixed Version: 6.10.0 64. Remediation: Update to version 6.10.0 or a later fixed version. 65. Vulnerability Description: Due to a missing authorization check on the function in versions up to and including 6.9.0, unauthorized data modification is possible. An attacker with subscriber-level permissions or higher can arbitrarily update site options. 66. Reference Link: www.tychesoftware.com 67. Vulnerability Database: Wordfence Intelligence Vulnerability Database 68. Vulnerability Score: 8.8 (High) 69. Vulnerability Disclosure Status: Public 70. Vulnerability Disclosure Date: November 25, 2024 71. Vulnerability Last Updated Date: November 26, 2024 72. Researcher: István Márton - Wordfence 73. Affected Versions: <= 6.9.0 74. Fixed Version: 6.10.0 75. Remediation: Update to version 6.10.0 or a later fixed version. 76. Vulnerability Description: Due to a missing authori

Goal Reached Thanks to every supporter — we hit 100%!

WooCommerce Booking & Appointment Plugin Authenticated Arbitrary Option Update Vulnerability

More from this source