CVE-2024-32720: 
WordPress vulnerability analysis and mitigation

The vulnerability (CVE-2024-32720) affects the CodePeople Appointment Hour Booking WordPress plugin versions through 1.4.56. It is classified as an Improper Restriction of Excessive Authentication Attempts vulnerability that allows removing important client functionality. The vulnerability was discovered by Mochamad Sofyan and was published on April 22, 2024 (Patchstack Database).

The vulnerability is categorized as a captcha bypass issue and has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The vulnerability is classified under CWE-307 (Improper Restriction of Excessive Authentication Attempts) (Patchstack Database).

The vulnerability has a low severity impact and allows unauthorized access to remove important client functionality. The CVSS score indicates that while the vulnerability can be exploited remotely with low attack complexity and requires no privileges or user interaction, it only affects integrity with low impact (Patchstack Database).

The vulnerability can be exploited by unauthenticated users, making it accessible to any potential attacker. However, it is considered unlikely to be exploited due to its low severity impact (Patchstack Database).

The vulnerability has been fixed in version 1.4.57 of the Appointment Hour Booking plugin. Users are advised to update to version 1.4.57 or later to remove the vulnerability. Patchstack users can enable auto-update for vulnerable plugins (Patchstack Database).