CVE-2024-10729

Summary

CVE-2024-10729 is a vulnerability affecting the Booking & Appointment Plugin for WooCommerce used on WordPress sites. The issue lies in the 'save_google_calendar_data' function, which lacks proper capability checks. As a result, authenticated attackers with subscriber-level permissions or higher can arbitrarily update site options, leading to unauthorized data modification. This vulnerability could potentially allow malicious actors to manipulate important settings, posing a significant risk to affected WordPress sites. It is recommended that users of this plugin upgrade to the latest version as soon as possible to mitigate this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.