CVE-2024-2441: VikBooking < 1.6.8 - Insecure Direct Object References
Published May 10, 2024
·Updated
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 allows direct access to menus, allowing an authenticated user with subscriber privileges or above, to bypass authorization and access settings of the VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's they shouldn't be allowed to.
Affected Software
2 affected components
VikBooking Hotel Booking Engine & PMS<1.6.8
vikwp Vikbooking Hotel Booking Engine \& Pms Wordpress<1.6.8
Event History
May 10, 2024
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
May 14, 2024
Data Sourced
via NVD·03:19 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-2441?
CVE-2024-2441 is rated as a medium severity vulnerability.
2
How do I fix CVE-2024-2441?
To fix CVE-2024-2441, update the VikBooking Hotel Booking Engine & PMS plugin to version 1.6.8 or later.
3
Who is affected by CVE-2024-2441?
Authenticated users with subscriber privileges or above are affected by CVE-2024-2441.
4
What type of vulnerability is CVE-2024-2441?
CVE-2024-2441 is an authorization bypass vulnerability.
5
What versions are affected by CVE-2024-2441?
CVE-2024-2441 affects VikBooking Hotel Booking Engine & PMS plugin versions prior to 1.6.8.