7.2
Élevée
CVE-2026-77705 The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a…
Description
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the password and email address of other users' WordPress accounts and take them over.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Booking for Appointments and Events Calendar 2.4 | premières → < 2.4.10 | 2.4.10 |
Autres CVE de Booking for Appointments and Events Calendar
Les 9 CVE de Booking for Appointments and Events Calendar →
CVE-2026-77689
The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was…
5.3
Moyenne
CVE-2026-14215
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a…
6.5
Moyenne
CVE-2026-77704
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the…
2.7
Faible
CVE-2026-14216
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before…
6.5
Moyenne