CVE-2025-12842

The Booking Plugin for WordPress Appointments – Time Slot plugin for WordPress is vulnerable to unauthorized email sending in versions up to, and including, 1.4.7 due to missing validation on the tslot_appt_email AJAX action. This makes it possible for unauthenticated attackers to send appointment notification emails to arbitrary recipients with attacker-controlled text content in certain email fields, potentially enabling the site to be abused for phishing campaigns or spam distribution.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/browser/timeslot/tags/1.4.6/public/form/email.php#L21
https://plugins.trac.wordpress.org/browser/timeslot/tags/1.4.6/public/form/email.php#L23
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3397527%40timeslot&new=3397527%40timeslot&sfp_email=&sfph_mail=
https://www.wordfence.com/threat-intel/vulnerabilities/id/087b6943-5da8-44fe-8614-832768444178?source=cve

Configurations

No configuration.

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) El plugin Booking para Citas de WordPress - Time Slot para WordPress es vulnerable al envío de correos electrónicos no autorizados en versiones hasta la 1.4.7, inclusive, debido a la falta de validación en la acción AJAX tslot_appt_email. Esto hace posible que atacantes no autenticados envíen correos electrónicos de notificación de citas a destinatarios arbitrarios con contenido de texto controlado por el atacante en ciertos campos del correo electrónico, lo que podría permitir que el sitio sea utilizado indebidamente para campañas de phishing o distribución de correo no deseado.

Information

Published : 2025-11-19 06:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-12842

Mitre link : CVE-2025-12842

CVE.ORG link : CVE-2025-12842

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2025-12842", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12842", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-19T20:13:13.236079Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "timeslotplugins", "product": "Time Slot \u2013 Booking and Appointment System", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.4.7"}], "defaultStatus": "unaffected"}]}], "published": "2025-11-19T06:15:46.990", "references": [{"url": "https://plugins.trac.wordpress.org/browser/timeslot/tags/1.4.6/public/form/email.php#L21", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/timeslot/tags/1.4.6/public/form/email.php#L23", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3397527%40timeslot&new=3397527%40timeslot&sfp_email=&sfph_mail=", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/087b6943-5da8-44fe-8614-832768444178?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "The Booking Plugin for WordPress Appointments \u2013 Time Slot plugin for WordPress is vulnerable to unauthorized email sending in versions up to, and including, 1.4.7 due to missing validation on the tslot_appt_email AJAX action. This makes it possible for unauthenticated attackers to send appointment notification emails to arbitrary recipients with attacker-controlled text content in certain email fields, potentially enabling the site to be abused for phishing campaigns or spam distribution."}, {"lang": "es", "value": "El plugin Booking para Citas de WordPress - Time Slot para WordPress es vulnerable al env\u00edo de correos electr\u00f3nicos no autorizados en versiones hasta la 1.4.7, inclusive, debido a la falta de validaci\u00f3n en la acci\u00f3n AJAX tslot_appt_email. Esto hace posible que atacantes no autenticados env\u00eden correos electr\u00f3nicos de notificaci\u00f3n de citas a destinatarios arbitrarios con contenido de texto controlado por el atacante en ciertos campos del correo electr\u00f3nico, lo que podr\u00eda permitir que el sitio sea utilizado indebidamente para campa\u00f1as de phishing o distribuci\u00f3n de correo no deseado."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "security@wordfence.com"}