CVE-2024-12558

Summary

CVE-2024-12558 is a vulnerability affecting the WP BASE Booking of Appointments, Services and Events plugin for WordPress. This issue allows authenticated attackers with Subscriber-level access or higher to gain unauthorized access to sensitive information from the plugin's database. The vulnerability is caused by a missing capability check on the export_db function, which exists in all versions up to and including 4.9.2. Attackers can exploit this flaw to expose hashed administrator passwords and other sensitive data, posing a significant risk to WordPress sites using this plugin.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.