CVE-2022-4036
29.11.2022, 21:15
The Appointment Hour Booking plugin for WordPress is vulnerable to CAPTCHA bypass in versions up to, and including, 1.3.72. This is due to the use of insufficiently strong hashing algorithm on the CAPTCHA secret that is also displayed to the user via a cookie.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| dwbooster | appointment_hour_booking | 𝑥 ≤ 1.3.72 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-804 - Guessable CAPTCHAThe software uses a CAPTCHA challenge, but the challenge can be guessed or automatically recognized by a non-human actor.
- CWE-326 - Inadequate Encryption StrengthThe software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
References