CVE-2022-1952: eaSYNC < 1.1.16 - Unauthenticated Arbitrary File Upload
The Free Booking Plugin for Hotels, Restaurant and Car Rental WordPress plugin before 1.1.16 suffers from insufficient input validation which leads to arbitrary file upload and subsequently to remote code execution. An AJAX action accessible to unauthenticated users is affected by this issue. An allowlist of valid file extensions is defined but is not used during the validation steps.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-1952?
CVE-2022-1952 has a severity rating that allows for arbitrary file upload, potentially leading to remote code execution.
How do I fix CVE-2022-1952?
To fix CVE-2022-1952, update the Free Booking Plugin for Hotels, Restaurant and Car Rental to version 1.1.16 or later.
What kind of vulnerability is CVE-2022-1952?
CVE-2022-1952 is a vulnerability related to insufficient input validation that can lead to remote code execution.
Who is affected by CVE-2022-1952?
CVE-2022-1952 affects users of the Free Booking Plugin for Hotels, Restaurant and Car Rental for WordPress versions prior to 1.1.16.
Can CVE-2022-1952 be exploited by unauthenticated users?
Yes, CVE-2022-1952 can be exploited by unauthenticated users due to an AJAX action vulnerability.