CyberRota Analysis
AI-GeneratedThe Bookit — Booking & Appointment Calendar WordPress plugin prior to version 2.6.0.5 is vulnerable due to a lack of authorization checks, enabling low-privilege users to access and read sensitive appointment records of other users. This exposure includes personal information such as customer names, email addresses, phone numbers, and private booking comments. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate potential data breaches.
Original NVD Description
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on one of its appointment-retrieval actions, allowing users with a low-privilege Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5-specific role to read other users' appointment records, including customer names, email addresses, phone numbers and private booking comments.