CVE-2024-8432

Name of the Vulnerable Software and Affected Versions: The Appointment & Event Booking Calendar Plugin – Webba Booking plugin for WordPress versions up to, and including, 5.0.48

Description: The issue allows authenticated attackers with Subscriber-level access and above to modify the booking form's CSS due to a missing capability check on the save appearance() function. This enables unauthorized modification of data.

Recommendations: For versions up to, and including, 5.0.48, update to a version that includes a fix for the missing capability check in the save appearance() function. As a temporary workaround, consider restricting access to the save appearance() function to prevent unauthorized modification of the booking form's CSS.