CVE-2024-11641: VikBooking Hotel Booking Engine & PMS <= 1.7.2 - Cross-Site Request Forgery to Authenticated (Subscriber+) Arbitrary File Upload
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.2. This is due to missing or incorrect nonce validation on the 'save' function. This makes it possible for unauthenticated attackers to change plugin access privileges via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Successful exploitation allows attackers with subscriber-level privileges and above to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11641?
CVE-2024-11641 is classified as a moderate severity vulnerability due to the potential for unauthorized actions on the affected WordPress plugin.
How do I fix CVE-2024-11641?
To fix CVE-2024-11641, update the VikBooking Hotel Booking Engine & PMS plugin to version 1.7.3 or later which includes the necessary nonce validation.
Who is affected by CVE-2024-11641?
Any user of the VikBooking Hotel Booking Engine & PMS plugin for WordPress running versions up to and including 1.7.2 is affected by CVE-2024-11641.
What type of vulnerability is CVE-2024-11641?
CVE-2024-11641 is a Cross-Site Request Forgery (CSRF) vulnerability.
Can CVE-2024-11641 be exploited by unauthenticated users?
Yes, CVE-2024-11641 can be exploited by unauthenticated attackers due to insufficient nonce validation.