Description

WordPress Plugin Appointment Booking Calendar and Online Scheduling-BookingPress is prone to an arbitrary file creation vulnerability. Exploiting this issue may allow attackers to create arbitrary files populated with content of files from local or remote sources, allowing the execution of any PHP code in those files, or the exposure of sensitive information. WordPress Plugin Appointment Booking Calendar and Online Scheduling-BookingPress version 1.1.5 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 1.1.6 or latest

References

https://www.wordfence.com/blog/2024/07/10000-wordpress-sites-affected-by-high-severity-vulnerabilities-in-bookingpress-wordpress-plugin/

https://plugins.trac.wordpress.org/changeset/3116857/bookingpress-appointment-booking/trunk/core/classes/class.bookingpress.php

Related Vulnerabilities

PHP Other Vulnerability (CVE-2006-3017)

WordPress Plugin Cart66 Lite::WordPress Ecommerce Multiple Vulnerabilities (1.5.1.14)

WordPress Plugin Let Them Unsubscribe Multiple Unspecified Vulnerabilities (1.0)

WordPress Plugin Tera Charts Cross-Site Scripting (1.0)

WordPress Plugin Google Analytics Dashboard Multiple Unspecified Vulnerabilities (2.0.5)

Severity

High

Classification

CVE-2024-6467 CWE-73 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update