Medium severity · published Nov 29, 2022
CVE-2022-4036
Appointment Hour Booking <= 1.3.72 - CAPTCHA Bypass
5.3
CVSS
0.5%
EPSS
No
On KEV
Description
The Appointment Hour Booking plugin for WordPress is vulnerable to CAPTCHA bypass in versions up to, and including, 1.3.72. This is due to the use of insufficiently strong hashing algorithm on the CAPTCHA secret that is also displayed to the user via a cookie.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AH
Appointment Hour Booking – Booking Calendar · codepeople
through 1.3.72 · source: vendor
AH
Appointment Hour Booking · Dwbooster
through 1.3.72 · source: NVD
Affected product
AH
Appointment Hour Booking – Booking Calendar
codepeople
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-4036
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-4036
Patch
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2803896%40appointment-hour-booking&new=2803896%40appointment-hour-booking&sfp_email=&sfph_mail=
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/f62d28bd-fa33-4f0b-a116-5aacc05bfa3a?source=cve
Third Party Advisory
https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4036
More from Appointment Hour Booking – Booking Calendar
7.8
CVE-2022-4034
Appointment Hour Booking <= 1.3.72 - CSV Injection
7.2
CVE-2026-96573
Appointment Hour Booking <= 1.5.97 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer
6.1
CVE-2022-4035
Appointment Hour Booking <= 1.3.72 - Unauthenticated iFrame Injection via Appointment Form
4.4
CVE-2026-1083
Appointment Hour Booking – Booking Calendar <= 1.5.60 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Min/Max Length' Field Configuration