CVE-2022-27862: WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 - Arbitrary File Upload leading to RCE
Arbitrary File Upload leading to RCE in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 on WordPress allows attackers to upload and execute dangerous file types (e.g. PHP shell) via the signature upload on the booking form.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2022-27862?
The severity of CVE-2022-27862 is critical with a value of 9.8.
What is the vulnerability in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin?
The vulnerability in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin is arbitrary file upload leading to remote code execution (RCE).
How does the vulnerability in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin allow attackers to execute dangerous file types?
The vulnerability allows attackers to upload and execute dangerous file types, such as PHP shells, via the signature upload on the booking form.
How can I fix the vulnerability in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin?
To fix the vulnerability, update E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin to version 1.5.4 or later.
Is there any additional information available about the vulnerability in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin?
Yes, you can find more information about the vulnerability in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin at the following references: [Reference 1](https://patchstack.com/database/vulnerability/vikbooking/wordpress-vikbooking-hotel-booking-engine-pms-plugin-1-5-3-arbitrary-file-upload-leading-to-rce) and [Reference 2](https://wordpress.org/plugins/vikbooking/#developers).