Description

WordPress Plugin VikBooking Hotel Booking Engine & PMS is prone to multiple vulnerabilities, including arbitrary file upload and information disclosure vulnerabilities. An attacker may leverage these issues to upload arbitrary code and run it in the context of the webserver process, which may facilitate unauthorized access or privilege escalation, or to obtain sensitive information that may help in launching further attacks. WordPress Plugin VikBooking Hotel Booking Engine & PMS version 1.5.3 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 1.5.4 or latest

References

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/vikbooking/vikbooking-hotel-booking-engine-pms-153-arbitrary-file-upload

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/vikbooking/vikbooking-hotel-booking-engine-pms-153-sensitive-information-exposure

https://plugins.svn.wordpress.org/vikbooking/trunk/changelog.md

Related Vulnerabilities

Microsoft SQL Server CVE-2023-36420 Vulnerability (CVE-2023-36420)

WordPress Plugin Great Quotes Cross-Site Scripting (1.0.0)

WordPress Plugin Photo Gallery by 10Web-Mobile-Friendly Image Gallery Cross-Site Scripting (1.2.12)

WordPress Plugin WP Support Plus Responsive Ticket System Unspecified Vulnerability (8.0.7)

IBM RTC Permissions, Privileges, and Access Controls Vulnerability (CVE-2015-4946)

Severity

High

Classification

CVE-2022-27862 CVE-2022-27863 CWE-200 CWE-434 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update