CVE-2022-2373

Simply Schedule Appointments < 1.5.7.7 - Unauthenticated Email Address Disclosure

The Simply Schedule Appointments WordPress plugin before 1.5.7.7 is missing authorisation in a REST endpoint, allowing unauthenticated users to retrieve WordPress users details such as name and email address

Affected

Simply Schedule Appointments – WordPress Booking Plugin

CVSS v3.1 NVD

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

1.86% chance of exploitation in the next 30 days, 79th percentile

Nuclei

medium · CWE-862

Published

2022-08-29

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/6aa9aa0d-b447-4584-a07e-b8a0d1b83a31

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2373.yaml

References

• CVE Record
• NVD entry