CVE-2024-12558
WP BASE Booking of Appointments, Services and Events <= 4.9.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via app_export_db
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
WP BASE Booking of Appointments, Services and Events <= 4.9.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via app_export_db
The WP BASE Booking of Appointments, Services and Events plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_db function in all versions up to, and including, 4.9.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to expose sensitive information from the database, such as the hashed administrator password.
Reserved 2024-12-11 | Published 2024-12-21 | Updated 2024-12-28 | Assigner Wordfence| 2024-12-20: | Disclosed |
Thanh Nam Tran
www.wordfence.com/...-8f79-4833-8fc6-f1af56c6abc8?source=cve
plugins.trac.wordpress.org/...udes/freeons/export-import.php
plugins.trac.wordpress.org/...%2Ffreeons%2Fexport-import.php
Support options
