CyberRota Analysis
AI-GeneratedThe Online Scheduling and Appointment Booking System plugin for WordPress prior to version 28.3 is vulnerable as it fails to properly verify that appointment and payment records accessed through staff-role AJAX actions belong to the requesting staff member. This flaw allows authenticated attackers with staff-level accounts to view, modify, and delete other staff members' appointments and payments, potentially exposing sensitive customer information. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate the risk of unauthorized access and data breaches.
Original NVD Description
The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff member, allowing authenticated attackers with a staff-level account to view, modify and delete other staff members' appointments and payments, including the associated customer's personal information.