Running a website, especially one that handles bookings, means keeping a close eye on security. Recently, a notable security weakness was discovered in the “Online Booking & Scheduling Calendar for WordPress by vcita” plugin. This flaw, tracked as CVE-2024-9872, allowed authenticated users with even basic subscriber-level access to potentially alter data and inject harmful scripts into websites using the plugin. This could lead to unauthorized changes to your booking settings or even compromise your site’s integrity. It’s a reminder of why staying updated with plugin security is so crucial for any WordPress administrator or developer.
CVE Details
The vulnerability, identified as CVE-2024-9872, primarily stems from a missing capability check within the plugin’s `vcita_save_user_data_callback()` function. This oversight meant that the plugin didn’t properly verify if a user had the necessary administrative permissions before allowing them to make significant changes.
- Product: Online Booking & Scheduling Calendar for WordPress by vcita
- Published Date: December 6, 2024
- Severity: Medium
- Status: Analyzed
Affected Products
This particular vulnerability impacts all versions of the “Online Booking & Scheduling Calendar for WordPress by vcita” plugin up to, and including, version 4.5.1. If your WordPress site uses this plugin and has not been updated beyond version 4.5.1, it is susceptible to this data modification flaw.
Current Status
As of February 20, 2026, this vulnerability is categorized as “Analyzed.” This means that the details of the flaw have been thoroughly investigated and understood by security researchers and the vendor. Crucially, a fix has been released.
Severity Level
The Common Vulnerability Scoring System (CVSS) assigns this vulnerability a score of 5.4, classifying it as “Medium” severity. While not critical, a medium severity rating indicates that the flaw could have a noticeable impact without requiring extremely complex attacks. In this case, an attacker needs to be an authenticated user (even a subscriber) on your WordPress site, which makes the attack less complex than one requiring no authentication at all. The potential for unauthorized data modification and script injection could still lead to defacement, redirection, or other unwanted actions on your website.
Possible Solutions
The good news is that a fix is available for this vulnerability. The developers of the vcita plugin have addressed the issue by implementing proper capability checks and nonce verification in the `vcita_save_user_data_callback()` function. This ensures that only authorized administrators can modify important settings.
To protect your website, the most critical step is to update your “Online Booking & Scheduling Calendar for WordPress by vcita” plugin to version 4.5.2 or newer immediately. This update includes the necessary security patches that prevent low-privileged users from exploiting this flaw. Always remember to back up your website before performing any plugin updates.
References
https://plugins.trac.wordpress.org/changeset/3200129/meeting-scheduler-by-vcita/trunk/vcita-ajax-function.php
https://www.wordfence.com/threat-intel/vulnerabilities/id/963c2d10-692b-4447-8d0b-7ccc2e533f01?source=cve
