Security Advisory

CVE-2023-2299

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2023-06-03 04:35:14

Last updated 2026-04-08 16:50:11

Assigner Wordfence

State PUBLISHED

Description

The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized medication of data via the /wp-json/vcita-wordpress/v1/actions/auth REST-API endpoint in versions up to, and including, 4.4.2 due to a missing capability check on the processAction function. This makes it possible for unauthenticated attackers modify the plugins settings.

← Browse all CVEs View on cve.org ↗