Veille CVE

‹ Retour à la liste

CVE-2026-105197

2.7 Faible

Publiée le 08/10/2026 à 08:16 · Modifiée le 08/10/2026 à 22:51 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The Appointment Booking Plugin WordPress plugin before 5.6.5 does not verify that a backend staff user is authorized to act on the specific record targeted for deletion, allowing an authenticated user with a record-scoped staff role to irreversibly delete any order, customer, or transaction on the site, including records belonging to other staff and outside their assigned scope.

Traduire en français

Produits concernés

Scores CVSS

VersionScoreSourceVecteur
3.1 2.7 Faible 134c704f-9b21-4f2e-91b3-4a467353bcc0 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Faiblesses (CWE)

Références

Ailleurs