Automattic Woocommerce Bookings vulnerabilities

2 CVEs affecting Automattic Woocommerce Bookings, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-32747, published 2023-12-21.

More from Automattic.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-32747, published 2023-12-21. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Bookings.This issue affects WooCommerce Bookings: from n/a through 1.15.78.
• CVE-2023-47787, published 2023-12-18. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Bookings.This issue affects WooCommerce Bookings: from n/a through 2.0.3.