VULNERABILITY INTELLIGENCE

CVE-2022-4036

CVSS score5.3 MEDIUM

EPSS probability0.47%

CISA KEVNot currently listed

Published2022-11-29

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description

The Appointment Hour Booking plugin for WordPress is vulnerable to CAPTCHA bypass in versions up to, and including, 1.3.72. This is due to the use of insufficiently strong hashing algorithm on the CAPTCHA secret that is also displayed to the user via a cookie.

Weakness classification

CWE-326: Inadequate Encryption Strength
CWE-804: Guessable CAPTCHA

Primary references

security@wordfence.com — Patch, Third Party Advisory
security@wordfence.com
security@wordfence.com — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory