7.5

CVE-2024-30516

WordPress Booking Package plugin <= 1.6.27 - Price Manipulation vulnerability

Booking Package <= 1.6.27 - Unauthenticated Price Manipulation

Improper Validation of Specified Quantity in Input vulnerability in SaasProject Booking Package allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Booking Package: from n/a through 1.6.27.
Mögliche Gegenmaßnahme
Booking Package: Update to version 1.6.29, or a newer patched version
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerSaasProject
≫
Produkt Booking Package
Default Statusunaffected
Version <= 1.6.27
Version n/a
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Booking Package
Version *-1.6.27
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.23% 0.143
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
audit@patchstack.com 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-1284 Improper Validation of Specified Quantity in Input

The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

https://patchstack.com/database/wordpress/plugin/booking-package/vulnerability/wordpress-booking-package-plugin-1-6-27-price-manipulation-vulnerability?_s_id=cve
https://www.wordfence.com/threat-intel/vulnerabilities/id/5b611abb-460c-44d4-9f77-052a208f8d85
Third Party Advisory