CVE-2025-67559
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The Online Booking & Scheduling Calendar for WordPress by vcita plugin, in versions up to and including 4.5.5, contains a Missing Authorization vulnerability. Incorrectly configured access control security levels can be exploited by an attacker to perform unauthorized actions.
Risk Assessment
An attacker could access functions or data they are not authorized to, potentially modifying bookings or disclosing information. This affects data integrity and confidentiality on the site.
Recommendation
Upgrade the plugin to a version later than 4.5.5. Verify role permissions and restrict access to the plugin's administrative functions.
Other vulnerabilities in Online Booking & Scheduling Calendar for WordPress by vcita
See all- CVE-2026-95513High
The Online Booking & Scheduling Calendar for WordPress by vcita plugin in versions up to and including 4.6.0 contains an unauthenticated Broken Access Control vulnerability. This allows access to functions or data that should be protected.
- CVE-2026-14433High
The Online Booking & Scheduling Calendar for WordPress by vcita plugin up to version 4.6.0 is vulnerable to stored cross-site scripting via the business_id parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a user accesses an injected page.
- CVE-2025-67472Medium
The Online Booking & Scheduling Calendar for WordPress by vcita plugin (meeting-scheduler-by-vcita) in versions up to and including 4.5.5 contains a Cross-Site Request Forgery (CSRF) vulnerability. The flaw allows an attacker to force a logged-in user to perform unwanted actions.
Original NVD description (English source)
Missing Authorization vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through <= 4.5.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS