roundaboutweb

There is also a warning at Wordfence:
https://ww.wp.xz.cn/support/topic/4-16-4-is-vulnerable-to-broken-access-control/

Please fix it soon

There is a workaround:

1. Create a new folder “mu-plugins” wp-content e.g. wp-content/mu-plugins
2. Create a new PHP file under “wp-content/mu-plugins” e.g. name it as function.php
3. Paste the snippet above and Save (https://pastebin.com/pxqxaULn)

<?php
add_filter ('em_bookings_get_booked_spaces', 'my_em_bookings_get_booked_spaces', 100, 3 );
function my_em_bookings_get_booked_spaces( $booked_spaces, $EM_Bookings, $force_refresh ) {
if( $EM_Bookings->booked_spaces === null || $force_refresh ){
$status_cond = !em_get_option('dbem_bookings_approval') ? '0,1' : 'booking_status = 1';
$booked_spaces = $EM_Bookings->get_status_count( $status_cond, $force_refresh );
$EM_Bookings->booked_spaces = $booked_spaces > 0 ? $booked_spaces : 0;
}
return $booked_spaces; }