vulnerability

WordPress Plugin: bookingpress-appointment-booking: CVE-2022-4340: Authorization Bypass Through User-Controlled Key

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:L/Au:N/C:P/I:P/A:N)

Published

Dec 7, 2022

Added

May 15, 2025

Modified

May 5, 2026

Description

The BookingPress plugin for WordPress is vulnerable to insecure direct object reference in versions up to, and including, 1.0.30. This is due to insufficient validation on the 'appointment_id' user-controlled key. This makes it possible for unauthenticated attackers to retrieve booking information that includes booked services along with the name and time of booking.

Solution

bookingpress-appointment-booking-plugin-cve-2022-4340

References

https://www.cve.org/CVERecord?id=CVE-2022-4340
https://www.wordfence.com/threat-intel/vulnerabilities/id/8019da67-fd2c-48f8-8983-6fb8fb30510b?source=api-prod
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-51693
CVE-2022-4340
https://attackerkb.com/topics/CVE-2022-4340
EUVD-EUVD-2022-51693

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report