CVE-2024-13677

Summary

CVE-2024-13677 is a privilege escalation vulnerability affecting the GetBookingsWP – Appointments Booking Calendar Plugin for WordPress. In versions up to 1.1.27, the plugin fails to adequately validate user identities while updating email addresses. This flaw enables attackers with subscriber-level access or higher to manipulate email addresses, including those of administrators. By doing so, they can reset passwords and gain unauthorized access to user accounts.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.