CVE-2024-3022: BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin <= 1.0.87 - Authenticated (Admin+) Arbitrary File Upload
The BookingPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient filename validation in the 'bookingpressprocessupload' function in all versions up to, and including 1.0.87. This allows an authenticated attacker with administrator-level capabilities or higher to upload arbitrary files on the affected site's server, enabling remote code execution.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3022?
CVE-2024-3022 is considered a high severity vulnerability due to its impact on file upload functionality allowing unauthorized file uploads.
How do I fix CVE-2024-3022?
To fix CVE-2024-3022, update the BookingPress plugin to a version higher than 1.0.87 where the vulnerability is addressed.
Who is affected by CVE-2024-3022?
CVE-2024-3022 affects users of the BookingPress plugin for WordPress with versions up to and including 1.0.87.
What type of attack does CVE-2024-3022 facilitate?
CVE-2024-3022 facilitates arbitrary file upload attacks by authenticated users with administrative privileges.
What is the nature of the vulnerability in CVE-2024-3022?
The vulnerability in CVE-2024-3022 is due to insufficient filename validation in the bookingpress_process_upload function, allowing potential exploitation.