CVE-2023-1129: 
WordPress vulnerability analysis and mitigation

CVE-2023-1129 affects the WP FEvents Book WordPress plugin through version 0.46. The vulnerability was discovered and publicly disclosed on April 3, 2023, by security researcher Ameen Alkurdy (WPScan).

The vulnerability is classified as an Insecure Direct Object Reference (IDOR) issue with a CVSS score of 4.3 (medium). The flaw exists because the plugin fails to verify that bookings being updated belong to the user making the request, which violates OWASP Top 10 category A5: Broken Access Control and is categorized as CWE-639 (WPScan).

This vulnerability allows any authenticated user to manipulate bookings on behalf of other users, including the ability to book events, add notes, or cancel bookings. The impact is amplified by the fact that the user ID parameter is an incremental numerical value, making it easily brute-forceable (WPScan).

The vulnerability can be exploited by authenticated users through intercepting booking-related requests and modifying the 'idUser' parameter. The exploitation process involves using an HTTP Proxy tool like BurpSuite to intercept and modify the requests (WPScan).

As of the latest reports, there is no known fix available for this vulnerability in the WP FEvents Book plugin (WPScan).