CVE-2024-9450: Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking < 1.3.15 - Subscriber+ PayPal Settings Update
The Free Booking Plugin for Hotels, Restaurants and Car Rentals WordPress plugin before 1.3.15 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in subscriber change them via a CSRF attack
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9450?
CVE-2024-9450 has a medium severity rating due to the risk of unauthorized settings changes through CSRF attacks.
How do I fix CVE-2024-9450?
To fix CVE-2024-9450, update the Free Booking Plugin for Hotels, Restaurants and Car Rentals to version 1.3.15 or later.
What systems are affected by CVE-2024-9450?
CVE-2024-9450 affects the Free Booking Plugin for Hotels, Restaurants and Car Rentals for WordPress prior to version 1.3.15.
What type of vulnerability is CVE-2024-9450?
CVE-2024-9450 is a Cross-Site Request Forgery (CSRF) vulnerability that allows unauthorized setting changes.
Who can exploit CVE-2024-9450?
Logged-in subscribers can exploit CVE-2024-9450 to change the plugin’s settings without proper authorization.