What’s Vulnerable › Vulnerabilities

CVE-2022-4340: BookingPress < 1.0.31 - Unauthenticated IDOR in appointment_id

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-01-02 · updated 2026-06-17

Description

The BookingPress WordPress plugin before 1.0.31 suffers from an Insecure Direct Object Reference (IDOR) vulnerability in it's thank you page, allowing any visitor to display information about any booking, including full name, date, time and service booked, by manipulating the appointment_id query parameter.

Affected products

• reputeinfosystems Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress: before 1.0.31 — fixed in 1.0.31

How to fix

Upgrade to a fixed version: reputeinfosystems Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress 1.0.31. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/8a7bd9f6-2789-474b-a237-01c643fdfba7
• https://wpscan.com/vulnerability/8a7bd9f6-2789-474b-a237-01c643fdfba7

Get alerted when CVE-2022-4340 or the next vulnerability affects your stack