CyberRota Analysis
AI-GeneratedThe Appointment Booking Plugin for WordPress prior to version 5.6.5 is vulnerable due to a lack of proper authorization checks, allowing authenticated users with a record-scoped staff role to delete any order, customer, or transaction, including those belonging to other staff members. This could lead to significant data loss and operational disruption for affected sites. WordPress administrators using this plugin should prioritize updating to the latest version to mitigate this risk.
Original NVD Description
The Appointment Booking Plugin WordPress plugin before 5.6.5 does not verify that a backend staff user is authorized to act on the specific record targeted for deletion, allowing an authenticated user with a record-scoped staff role to irreversibly delete any order, customer, or transaction on the site, including records belonging to other staff and outside their assigned scope.