CVE-2024-33543: 
WordPress vulnerability analysis and mitigation

The WP Time Slots Booking Form WordPress plugin contains a Missing Authorization vulnerability affecting versions up to 1.2.06. This security issue was discovered and reported by Joshua Chan, with the vulnerability being assigned CVE-2024-33543. The vulnerability was publicly disclosed on April 25, 2024 (Patchstack).

The vulnerability is classified as a Broken Access Control issue (CWE-863) with a CVSS score of 5.3 (medium severity). The security flaw stems from insufficient server-side validation of prices, which allows for price manipulation in the booking system (WPScan).

This vulnerability enables unauthenticated attackers to alter the price of bookings in the WP Time Slots Booking Form plugin, potentially leading to financial impact for website owners (Patchstack).

The vulnerability can be exploited by unauthenticated users, requiring no special privileges or user interaction. The attack complexity is considered low, making it relatively straightforward to exploit (WPScan).

The vulnerability has been fixed in version 1.2.07 of the WP Time Slots Booking Form plugin. Website administrators are advised to update to this version or later to remediate the security issue (Patchstack).