Summary
The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose other customers' personal information and booking cancellation tokens.
Risk profile
5.3 · M E D I U M
CVSS assessment
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Attack vector
- N E T W O R K
- Complexity
- L O W
- Privileges
- N O N E
- User interaction
- N O N E
- Scope
- U N C H A N G E D
- Confidentiality
- L O W
- Integrity
- N O N E
- Availability
- N O N E
Weaknesses
-
Exposure of Sensitive Information to an Unauthorized Actor
CWE-200
Further reading
1
source