Description

WordPress Plugin VikBooking Hotel Booking Engine & PMS is prone to multiple vulnerabilities, including arbitrary file upload and information disclosure vulnerabilities. An attacker may leverage these issues to upload arbitrary code and run it in the context of the webserver process, which may facilitate unauthorized access or privilege escalation, or to obtain sensitive information that may help in launching further attacks. WordPress Plugin VikBooking Hotel Booking Engine & PMS version 1.5.3 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 1.5.4 or latest

References

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/vikbooking/vikbooking-hotel-booking-engine-pms-153-arbitrary-file-upload

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/vikbooking/vikbooking-hotel-booking-engine-pms-153-sensitive-information-exposure

https://plugins.svn.wordpress.org/vikbooking/trunk/changelog.md

Related Vulnerabilities

MySQL CVE-2015-0500 Vulnerability (CVE-2015-0500)

Play Framework Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2020-12480)

WordPress 4.5.x Multiple Vulnerabilities (4.5 - 4.5.15)

Oracle JRE CVE-2014-2398 Vulnerability (CVE-2014-2398)

WordPress Improper Authentication Vulnerability (CVE-2014-0166)

Severity

High

Classification

CVE-2022-27862 CVE-2022-27863 CWE-200 CWE-434 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update