Description

WordPress Plugin Appointment Booking Calendar and Online Scheduling-BookingPress is prone to an arbitrary file creation vulnerability. Exploiting this issue may allow attackers to create arbitrary files populated with content of files from local or remote sources, allowing the execution of any PHP code in those files, or the exposure of sensitive information. WordPress Plugin Appointment Booking Calendar and Online Scheduling-BookingPress version 1.1.5 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 1.1.6 or latest

References

https://www.wordfence.com/blog/2024/07/10000-wordpress-sites-affected-by-high-severity-vulnerabilities-in-bookingpress-wordpress-plugin/

https://plugins.trac.wordpress.org/changeset/3116857/bookingpress-appointment-booking/trunk/core/classes/class.bookingpress.php

Related Vulnerabilities

WordPress Plugin CSS JS Manager, Async JavaScript, Defer Render Blocking CSS supports WooCommerce Cross-Site Request Forgery (2.4.49)

WordPress Plugin Limit Attempts by BestWebSoft Cross-Site Scripting (1.1.7)

PHP Out-of-bounds Read Vulnerability (CVE-2019-11046)

WordPress Plugin 404page-your smart custom 404 error page Cross-Site Request Forgery (10.3)

WordPress Plugin WP-Cron Dashboard Cross-Site Scripting (1.1.5)

Severity

High

Classification

CVE-2024-6467 CWE-73 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update