CVE-2024-7855: WP Hotel Booking <= 2.1.2 - Authenticated (Subscriber+) Arbitrary File Upload
The WP Hotel Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the updatereview() function in all versions up to, and including, 2.1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7855?
CVE-2024-7855 has a high severity rating due to its potential for arbitrary file uploads by authenticated attackers.
How do I fix CVE-2024-7855?
To fix CVE-2024-7855, upgrade the WP Hotel Booking plugin to version 2.1.3 or later, which includes proper file type validation.
Who is affected by CVE-2024-7855?
CVE-2024-7855 affects users of the WP Hotel Booking plugin for WordPress with versions up to and including 2.1.2.
What kind of exploit does CVE-2024-7855 allow?
CVE-2024-7855 allows authenticated attackers to upload arbitrary files, compromising the security of the WordPress site.
Is there a patch available for CVE-2024-7855?
Yes, a patch is available in the updated version 2.1.3 of the WP Hotel Booking plugin.