CyberRota Analysis
AI-GeneratedThe Bookit Booking & Appointment Calendar plugin for WordPress prior to version 2.6.0.5 is vulnerable due to a lack of capability checks in its appointment-deletion functionality, enabling low-privileged users with the custom Staff role to delete any appointment. This flaw poses a significant risk of unauthorized data manipulation, potentially disrupting business operations and user trust. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this risk.
Original NVD Description
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, allowing users with its low-privileged custom Staff role to delete arbitrary appointments.