Appointment Booking Calendar WordPress Plugin Sensitive Information Exposure Vulnerability

A vulnerability allowing sensitive information exposure has been identified in the Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin for WordPress, affecting all versions through 1.6.9.5. The issue arises from the hash() function's use of a hardcoded fallback salt, which enables unauthenticated attackers to generate valid tokens across different sites using the plugin. This is possible on sites that have not manually set a salt in the wp-config.php file, potentially allowing unauthorized access to booking information and the ability to make modifications.

Impact

Exploitation of this vulnerability could lead to unauthorized access to booking information, allowing attackers to make unauthorized modifications.

Remediation

Users are advised to update the Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin to version 1.6.9.6 or a newer patched version.