CVE-2024-6660: 
WordPress vulnerability analysis and mitigation

The BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin for WordPress contains a privilege escalation vulnerability (CVE-2024-6660) affecting all versions up to and including 1.1.5. The vulnerability stems from a missing capability check in the bookingpress_import_data_continue_process_func function, which allows authenticated attackers with Subscriber-level access or higher to perform unauthorized actions (NVD).

The vulnerability is caused by insufficient authorization controls in the import data processing functionality. The affected function lacks proper capability verification, enabling authenticated users with minimal privileges to execute privileged operations. The vulnerability has been assigned a CVSS v3.1 score of 8.8 (HIGH), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a serious security risk (NVD).

The vulnerability allows authenticated attackers to update arbitrary options on the WordPress site and upload arbitrary files. More critically, attackers can exploit this to modify the default role for new user registrations to administrator and enable user registration, effectively gaining administrative access to the vulnerable site (NVD).

The vulnerability can be exploited by any authenticated user with Subscriber-level access or higher. The attack requires low complexity and no user interaction, making it relatively straightforward to exploit (NVD).

The vulnerability has been patched in version 1.1.6 of the plugin. Site administrators should update to this version immediately to protect their installations (WordPress Plugin).