CyberRota Analysis
AI-GeneratedThe Appointment Booking Plugin for WordPress prior to version 5.6.9 lacks proper authorization controls, enabling authenticated users with the LatePoint Agent role to access and modify profile data and bookings of other agents. This vulnerability could lead to unauthorized data exposure and manipulation of sensitive customer information. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate potential risks.
Original NVD Description
The Appointment Booking Plugin WordPress plugin before 5.6.9 does not enforce per-record authorization on several of its AI Abilities API actions, allowing an authenticated user holding the LatePoint Agent role, normally restricted to their own records, to read and modify other agents' profile data and read other agents' bookings and associated customer details when the Abilities API feature is enabled.