CVE-2026-77705

7.2 Élevée

Publiée le 12/09/2026 à 08:16 · Modifiée le 14/09/2026 à 23:10 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the password and email address of other users' WordPress accounts and take them over.

Traduire en français

Produits concernés

Unknown Booking for Appointments and Events Calendar

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.2 Élevée	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-639

Références

https://wpscan.com/vulnerability/bfd0ce74-f91e-41fe-8288-7b1d34dd16fe/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories