Wp Ical Availability Vulnerabilities

The WP iCal Availability plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on one of its functions in versions up to, and including, 1.0.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to invoke this function. The exa...

CVSS:

4.3

Affected:

up to 1.0.3

Fix:

No patched version reported

Disclosed:

Oct 24, 2023

CVE-2023-46607 on NVD →

The WP iCal Availability plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.3. This is due to missing nonce validation on the wpia_settings() function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request granted th...

CVSS:

4.3

Affected:

up to 1.0.3

Fix:

No patched version reported

Disclosed:

Sep 5, 2023

CVE-2023-41853 on NVD →