The Smart Appointment & Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and a nonce validation logic flaw in the saab_cancel_booking() function in all versions up to, and including, 1.0.8. The nonce check uses && (AND) instead of || (OR), which means providing any value for the security parameter causes the entire check to be skipped. This makes it possible for unauthenticated attackers to cancel arbitrary bookings by supplying a predictable booking ID.
The Smart Appointment & Booking WordPress plugin versions up to 1.0.8 contains a critical authorization bypass in the booking cancellation function due to improper nonce validation logic using AND instead of OR operators. Unauthenticated attackers can cancel arbitrary bookings by exploiting this flaw with predictable booking IDs.
يحتوي مكون Smart Appointment & Booking للـ WordPress على خلل في التحقق من صحة nonce في دالة saab_cancel_booking() حيث يتم استخدام عامل AND بدلاً من OR، مما يسمح بتجاوز فحص الأمان بالكامل. يمكن للمهاجمين غير المصرح لهم إلغاء أي حجز تعسفي من خلال توفير معرف حجز يمكن التنبؤ به.
The Smart Appointment & Booking WordPress plugin versions up to 1.0.8 contains a critical authorization bypass in the booking cancellation function due to improper nonce validation logic using AND instead of OR operators. Unauthenticated attackers can cancel arbitrary bookings by exploiting this flaw with predictable booking IDs.
Update the Smart Appointment & Booking plugin to version 1.0.9 or later immediately. Review and audit all booking cancellations in your system for unauthorized modifications. Implement Web Application Firewall (WAF) rules to detect and block suspicious booking cancellation requests. Disable the plugin if an update is unavailable and use alternative appointment booking solutions.
قم بتحديث مكون الحجز والمواعيد الذكية إلى الإصدار 1.0.9 أو أحدث فوراً. راجع وتدقق جميع عمليات إلغاء الحجوزات في نظامك للتحقق من التعديلات غير المصرح بها. طبق قواعد جدار الحماية لتطبيقات الويب لكشف وحجب طلبات إلغاء الحجوزات المريبة. عطل المكون إذا لم يكن التحديث متاحاً واستخدم حلول حجز المواعيد البديلة.