CVE-2024-12274

BookingPress < 1.1.23 - Unauthenticated Export File Download

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.1.23 export settings functionality exports data to a public folder, with an easily guessable file name, allowing unauthenticated attackers to access the exported files (if they exist).

Affected

Appointment Booking Calendar Plugin and Scheduling Plugin

CVSS v3.1 CNA

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.64% chance of exploitation in the next 30 days, 50th percentile

Published

2025-01-13

Updated

2025-08-27

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/e3176c9a-63f3-4a28-a8a7-8abb2b4100ef/

Security advisories

• https://wpscan.com/vulnerability/e3176c9a-63f3-4a28-a8a7-8abb2b4100ef

References

• CVE Record
• NVD entry