CVE-2025-46247: fallo de gravedad media en codepeople Appointment Booking Calendar
WordPress Appointment Booking Calendar plugin <= 1.3.92 - Broken Access Control Vulnerability
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3epss 0.4%
Missing Authorization vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Appointment Booking Calendar: from n/a through <= 1.3.92.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Productos afectados
codepeople · Appointment Booking CalendarCVEs relacionadas — codepeople Appointment Booking Calendar
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-12113MEDIUMAppointment Booking Calendar <= 1.4.02 - Missing Authorization to Authenticated (Contributor+) Sensitive Information DisclosureEPSS 0.4%CVE-2025-13317MEDIUMAppointment Booking Calendar <= 1.3.96 - Missing Authorization to Arbitrary Booking Confirmation via 'cpabc_ipncheck' ParameterEPSS 0.3%CVE-2026-12111MEDIUMAppointment Booking Calendar <= 1.4.01 - Authenticated (Contributor+) Sensitive Information Exposure via 'id' ParameterEPSS 0.3%CVE-2025-64261MEDIUMWordPress Appointment Booking Calendar plugin <= 1.3.95 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-111727MEDIUMAppointment Booking Calendar <= 1.4.05 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'vs_text_submitbtn' ParameterEPSS 0.2%CVE-2025-46241HIGHWordPress Appointment Booking Calendar plugin <= 1.3.92 - CSRF to SQL Injection vulnerabilityEPSS 0.2%