Booking & Appointment Plugin for WooCommerce <= 6.9.0 - Authenticated (Subscriber+) Arbitrary Option Update
Strategic Overview
- Status
- Patched in 6.10.0
- Affected Plugin
- Booking & Appointment Plugin for WooCommerce
- Affected Version
<= 6.9.0- CVSS
- 8.8High
- Weakness type
- CWE-285 · Improper Authorization
- CVE
CVE-2024-10729
At a glance
CVE-2024-10729 is a high-severity Improper Authorization vulnerability in the Booking & Appointment Plugin for WooCommerce WordPress plugin, affecting versions <= 6.9.0. It carries a CVSS score of 8.8 (reachable over the network; low attack complexity; high confidentiality, integrity, availability impact). Exploitation requires an authenticated account at Subscriber level or above. The issue is fixed in version 6.10.0; sites on affected versions should update now. Disclosed November 2024, reported by István Márton.
Vulnerability Overview
The Booking & Appointment Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_google_calendar_data' function in versions up to, and including, 6.9.0. This makes it possible for authenticated attackers, with subscriber-level permissions or above to update the site options arbitrarily.
Technical Analysis
The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no interaction from a victim user. A successful exploit has high impact on confidentiality, integrity, availability — full site compromise territory.
CWE-285: Improper Authorization
Booking & Appointment Plugin for WooCommerce <= 6.9.0 carries this weakness at save_google_calendar_data, and reaching it takes an account at Subscriber level or above. Improper authorization means a permission check exists but does not cover the case being exercised, so a caller who is allowed to do one thing is allowed to do a neighbouring thing as well.
A lower-privileged account performs an action reserved for a higher one, which on a multi-author or membership site means an ordinary user reaching administrative behaviour. For Booking & Appointment Plugin for WooCommerce the fix is 6.10.0: builds <= 6.9.0 are affected, anything from 6.10.0 onward is not.
Remediation
Update to version 6.10.0, or a newer patched version
How does WordSec protect against this?
Because it turns on account access, WordSec's login security is the relevant layer: role-based two-factor, captcha and brute-force limits raise the cost of getting the account this needs. None of that substitutes for the fix: Booking & Appointment Plugin for WooCommerce 6.10.0 closes this, and updating the plugin is the step that ends it.
- Login Security
- Alerts
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C